On Tue, 2004-11-23 at 11:23 -0800, Stephen Pollei wrote:
Works for local networks, but once the routers get involved.... It's
even worse than a chain of ten forwarding mail servers, it varying
chains of on average eight to thirty-two hops of routers.
Thank you. The scale is different, yes -- but it's just like forwarding
really. They _could_ do NAT when I suddenly declare that what they've
been doing for decades is 'forgery'. But they won't.
So I think you'd be hard pressed to bet IPsec with opportunistic keying,
then you simply sign the packets.
Very true. And I'll probably implement DomainKeys or IIM instead of SPF
for mail, for the same reasons.
--
dwmw2