Daniel Taylor wrote:
As I pointed out, a formal reputation system is not necessary
to catch fly-by-nights. New domains will usually be suspect,
just as people are reluctant to do critical business with
companies that are "too new", and new domains with overly permissive
SPF records will probably get blackholed with the rest of the
untrusted internet.
How does a mail server know the domain is new? It has to do a whois lookup.
Have you ever tried parsing arbitrary whois data? Have you ever tried
requesting hundreds of whois lookups from the same IP in one day? If you have,
you probably found that your IP got blocked by the owner of the whois server.
A reputation scheme will require a whole new infrastructure, and someone will
have to pay for it. And everyone will have to trust it...
Paul.