Re: [ietf-dkim] DKIM+ADSP = FAIL, and it's our fault

On Sep 15, 2010, at 11:02 AM, Jeff Macdonald wrote:

> On Wed, Sep 15, 2010 at 10:43 AM, McDowell, Brett
> <bmcdowell(_at_)paypal-inc(_dot_)com> wrote:
> > On Sep 15, 2010, at 12:11 AM, Murray S. Kucherawy wrote:
> >
> > > Based on that (rather precise) description, aren't ADSP's requirements a 
> > > proper subset of the DKIM requirements?  If so, I'm not sure I agree with 
> > > "badly conflicting", but it does frame future discussion quite nicely.
> > >
> > > For example, if DKIM enables the identification of mail streams, isn't the 
> > > one ADSP covers just a specific instance of a mail stream?
> > BTW, one thing I think we can agree on and find value from in these 
> > pre-deployment email discussions is terminology.  I ran into a problem at 
> > the last MAAWG during a panel discussion where my understanding of 
> > "3rd-party signature" is what someone else meant by "2nd-party signature".  
> > What is the real definitions of "1st-party", "2nd-party" and "3rd-party" 
> > signatures in the context of DKIM and ADSP, i.e. in the context of i= and d= 
> > and from: values?
> I believe only the ADSP documents talk about 3rd party, and it is
> defined as d= not From Domain.
>
> These are 3rd party:
>
> DKIM-Sig: ... d=dkim.bar.com
> From: foo(_at_)bar(_dot_)com
>
> DKIM-Sig: ... d=beer.com
> From: foo(_at_)bar(_dot_)com
>
> I believe Patrick defined 2nd party to be:
> DKIM-Sig: ... d=dkim.bar.com
> From: foo(_at_)bar(_dot_)com
>
> the maawg meeting was a first that I've heard that.
>
> First party is of course:
>
> DKIM-Sig: ... d=bar.com
> From: foo(_at_)bar(_dot_)com
>
>
> BUT I really thinking making such distinctions is the wrong approach.
> It really doesn't matter what type of signature it is. I'd even
> advocate for a DKIM update that would cause all signatures to be 2nd
> or 3rd to enforce the point.
That seems aligned with Steve's point about DKIM's value coming (only?) when 
the d= value is not the same as the domain-name in the from: field.  So 
according to you (and Steve?) the IETF should pass a normative requirement that 
all verified email be hired out to 3rd parties?!  That strikes me as very 
anti-Internet.



_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html