John,
I understand that Sender ID, as currently written, does
not prevent joe jobbing and the associated "blowback" or
"backscatter" problem that results from this practice.
I disagree with Chris that Sender ID makes this problem
significantly worse than it is right now. Why? Because
his example assumes that a hacker/spammer/zombie has gained
access to an MTA that is willing to accept mail with
a reverse-path in the victim's domain. At this point, it
is not difficult to construct messages that will be rejected
with 5xy errors at the recipient's relay. You don't need
the recipient's MTA to have implemented Sender ID testing
to make that happen.
I think a proposal that would enable both reverse-path
and PRA authentication is definitely a worthwhile endeavor.
But I wouldn't necessarily throw away the existing Sender ID
proposal on the basis that it doesn't solve a problem that
the authors chose not to solve in the first place. (Read
http://www.ietf.org/internet-drafts/draft-ietf-marid-rationale-00.txt
for more insight into that choice.)
Daryl Odnert
Tumbleweed Communications
Redwood City, California