| I realize that opinions differ, but I would like to see a scheme like
| CSV that uses an IP address to identify an MTA, and handle individual
| messages using something like Domain Keys that authenticates the
| message itself rather than a probably shared message source.
If Domain Keys signs messages at the MTA, the mix of good
and bad mail you mentioned will all acquire a DK signature.
That entirely depends on the MTA's policy. If I set up my MTA to sign
messages, I'd only sign the ones that I had some reason to trust,
e.g., the sender AUTHed when it injected the message and it's a domain
I know. Or, of course, a sufficiently robust sender like an internal
mailing list server could sign them itself and my MTA just passes them
along. But the point is that senders get to decide what messages they
will vouch for, rather than recipients trying to guess from ever more
complex SPF-ish descriptions what mail is good and what mail isn't.
If we turn to per-user PGP, we end up with the same problem,
If we want PGP, we know where to find it. We all know about its
key distribution problems, so unless I'm missing something, nobody's
proposing it for MARID or son-of-MARID.
Regards,
John Levine, johnl(_at_)taugh(_dot_)com, Taughannock Networks, Trumansburg NY
http://www.taugh.com