spf-discuss
[Top] [All Lists]

Re: Authentication vs. Authorization

2005-05-21 20:57:37
In <200505211702(_dot_)55793(_dot_)bulk(_at_)mehnle(_dot_)net> Julian Mehnle 
<bulk(_at_)mehnle(_dot_)net> writes:

Bill Taroli wrote:
| 2.5.3.  Pass
| 
|    A "Pass" result means that the client is authorized to inject mail
|    with the given identity.  Further policy checks, such as reputation,
|    or black and/or white listing, can now proceed with confidence in the
|    identity.

Therefore I think we should adopt Scott Kitterman's proposal:

| 2.5.3.  Pass
|
|    [same as above]  The domain used in the given identity
|    accepts responsibility for messages from the client.  Further
|    identity base [same as above]

Wayne, what do you think?

I think that "accepts responsibility" is a loaded term that will scare
away people from publishing SPF records.  Does that mean that the
domain owner must accept all responsiblity for any illegal, immoral or
unethical behavior that the MTA owner and/or user of that MTA may do?

Do you want to try and add a paragraph and a half qualifying just what
kinds of responsiblities the domain owner is accepting?

Is this kind of responsibility something that current SPF publishers
have already accepted?  If not, should we retroactively foist such
responsibility on them?


As much as I might like to increase the accountability of MTA owners,
I think this is a *REALLY* bad idea.   I confess that I didn't
initially see it this way, but it is something that, thinking about
it, just started to bug me.


-wayne


<Prev in Thread] Current Thread [Next in Thread>