Meng Weng Wong wrote:
given DOMAIN, attempt to connect to https://www.DOMAIN/.
If an HTTPS connection succeeds, and the certificate for
DOMAIN is valid, that makes it somewhat more likely that
the sender is a good guy.
Hmm, I would like the PGP way better:
1. I generate PGP private/public pair for fortytwo.eu.org
2. public key is in DNS, let's say in a TXT RR
3. MX host ("foo.bar.org") sees SMTP connection (sender address is
j(_dot_)doe(_at_)fortytwo(_dot_)eu(_dot_)org) and says "450 back in 5 minutes" or - better "650
please hold the line" (yes, 6xx codes do not exist - yet?)
4. sender ("foo.bar.org") gets fortytwo.eu.org's TXT record, thus the key
5. sender signs machine generated message to fortytwo.eu.org's MX with
lowest number, containing J. Doe's sending IP
6. my MX host replies automatically with "OK", "FAIL" or "DUNNO" and either
sends is as is or - if available - encrypts the answer with foo.bar.org's
public key. *OR* my MX is under attack and cannot answer.
7. foo.bar.org then decides what to to with the sending host. If it gets no
answer from fortytwo.eu.org within 5 minutes, it says 450 to the sender and
blocks it for 10 Minutes.
8. foo.bar.org is not allowed to query fortytwo.eu.org's for one hour, it
must cache it for this time.
Instead of 2. we could look at RFC2782 and define something like
_pgp._udp SRV 0 0 24 pgpkeys.fortytwo.eu.org.
in DNS. OK, maybe I just reinvented the wheel, these are just my 2 cents.
Olaf