When buying insurance from a broker, one of the first precautions is to
check the name and license of that broker against an institutional
registry. The broker may then present several insurance plans, where
then names of these insurance companies would be checked and may be
asked to confirm their relationship with the broker.
Many states relegate insurance brokers to a status of an order taker
charged with the responsibility for placing coverage or giving the
client timely notice that they cannot do so. They also often play an
important role of tracking performance of insurance companies to protect
their clients by not offering coverage from known bad actors.
In this analogy, there are many more insurance companies than brokers,
and an insurance broker could work out of many offices where these
offices may be shared by other brokers. Imagine buying coverage from an
anonymous broker, where both the insurance company and the broker are
checked by asking the insurance company for a list of all the office
addresses of their brokers. These lists may be large, and to gather the
entire list, partial lists must be obtained from each of their divisions
where they are maintained separately.
If there is a problem, there is a more fundamental problem. With whom
did the actual transaction take place? Worst still, some offices are
not secure, and some insurance companies have roaming brokers. This
method of checking will force clients not to deal with insurance
companies with roaming brokers where lists read "and other offices."
Rather than checking the reputation of the broker, with this address
list scheme, the check must be made against the office address. (Some
claim reputations can be based upon the insurance company when using
anonymous brokers. This could never be defended however.)
Checking the identity of the broker first makes obtaining the cumbersome
office address list unnecessary. If there is a problem, the trusted
party in the transaction claiming to have been acting on behalf of the
insurance company is known. Checks that only compare addresses provided
by an insurance company of all broker's offices, makes holding an
insurance company liable difficult. The insurance company can readily
claim to have not been part of the transaction. One may provide
authorities the office address and color this office suspect, while
there may be other brokers sharing that office. The broker causing the
problem may work out of many offices. Hardly an effective means to
curtail trouble.
Anyone looking at this strange checking scheme would quickly point out
the basic flaw. One must validate the broker and then establish the
relationship with the insurance company by name. But this is not how
Sender-ID works. As it turns out, checking the name of the broker,
otherwise known as the Mail Transfer Agent, can be done with no extra
overhead. If there is a problem, the name of the MTA earns the
reputation. After all, part of their job is to protect their clients
from the bad actors.
By using the insurance broker model, an efficient and fair scheme of
assessing the acts of the MTA becomes possible. As with insurance
companies, domains could restrict their coverage to be handled by a few
agents by name, rather than by address. This can be easily asserted
with a simple name list which hides the delegation of addresses.
Roaming from office to office is without a problem, as the name is used
to establish trust.
-Doug