IETF Logo Mail Archive

Re: [dmarc-ietf] Updated mandatory tag/conditional signature draft

"Murray S. Kucherawy" <superuser@gmail.com> Thu, 09 April 2015 21:47 UTC

Return-Path: <superuser@gmail.com>
X-Original-To: dmarc@ietfa.amsl.com
Delivered-To: dmarc@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9C4D21A88C0 for <dmarc@ietfa.amsl.com>; Thu, 9 Apr 2015 14:47:30 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3yrufyYLyOWK for <dmarc@ietfa.amsl.com>; Thu, 9 Apr 2015 14:47:28 -0700 (PDT)
Received: from mail-wi0-x235.google.com (mail-wi0-x235.google.com [IPv6:2a00:1450:400c:c05::235]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 0589B1A8906 for <dmarc@ietf.org>; Thu, 9 Apr 2015 14:47:28 -0700 (PDT)
Received: by widdi4 with SMTP id di4so107775808wid.0 for <dmarc@ietf.org>; Thu, 09 Apr 2015 14:47:26 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=E5IXRUl0RuhsLfei3NNCwDcEQeSnonisLJOF1U1YcsY=; b=P+EJZp3glpH6FN21iltBBxAjGx7ij8emsQ0mRGmXa+CQlp3fX6yN9PnC3xxY3yghi+ K8918CJywnnleskldl3+8FwEjxssrZUjKkcR4JArMN+pDqt6tunRqRb6xemYFeckWkJA EqCJE/jdBuLAlEb7UK+PORO/sWZK4l8ssSGc2AeFrutxgNXkPmzA//cpHU0FYaoGj/RY Wz9r8qYal3qVxl3XB2j8bOhTNnCm3uTUOgqPUEyBwZZgdsJzQAIhqOXoad6NsWv41dtx lQruEsn+UPSIyPeGtWe6xbjFX+jzl5p1DoSrVXdPm49CjTLpEhaKgvnPVFNPfW57M/wZ yjhQ==
MIME-Version: 1.0
X-Received: by 10.180.99.2 with SMTP id em2mr9733508wib.59.1428616046833; Thu, 09 Apr 2015 14:47:26 -0700 (PDT)
Received: by 10.27.92.17 with HTTP; Thu, 9 Apr 2015 14:47:26 -0700 (PDT)
In-Reply-To: <CABa8R6tObGnpjV0Fq5DV2hHYA2Rj33nsKyEduy7Eqqx4SRAVSw@mail.gmail.com>
References: <20150409020637.34444.qmail@ary.lan> <CAL0qLwZyZUO2ZJGcS3PMmMU5+qXSmKm2UeUveYujpNy9CVSJyw@mail.gmail.com> <55266C2B.4040708@isdg.net> <20559.1428585884@vindemiatrix.encs.concordia.ca> <552689EE.4090408@sonnection.nl> <5526C6AA.2060508@isdg.net> <CABa8R6tObGnpjV0Fq5DV2hHYA2Rj33nsKyEduy7Eqqx4SRAVSw@mail.gmail.com>
Date: Thu, 09 Apr 2015 14:47:26 -0700
Message-ID: <CAL0qLwZZRZKAffZL2tHmX9X9rQtU07QaxZpq9iAkmM-Pec_FfA@mail.gmail.com>
From: "Murray S. Kucherawy" <superuser@gmail.com>
To: Brandon Long <blong@google.com>
Content-Type: multipart/alternative; boundary="f46d04426c68fdf4d20513519738"
Archived-At: <http://mailarchive.ietf.org/arch/msg/dmarc/U6Q9uQVeKZhLRHRAxwHb0x8lgcY>
Cc: "<R.E.Sonneveld@sonnection.nl>" <R.E.Sonneveld@sonnection.nl>, Anne Bennett <anne@encs.concordia.ca>, "dmarc@ietf.org" <dmarc@ietf.org>, Hector Santos <hsantos@isdg.net>
Subject: Re: [dmarc-ietf] Updated mandatory tag/conditional signature draft
X-BeenThere: dmarc@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: "Domain-based Message Authentication, Reporting, and Compliance \(DMARC\)" <dmarc.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dmarc>, <mailto:dmarc-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/dmarc/>
List-Post: <mailto:dmarc@ietf.org>
List-Help: <mailto:dmarc-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dmarc>, <mailto:dmarc-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 09 Apr 2015 21:47:30 -0000

On Thu, Apr 9, 2015 at 1:18 PM, Brandon Long <blong@google.com> wrote:

> Since you're continuing this push for atps, I should point out again our
> issue.  Its not with some editor or serving the large number of records.
>

> Its how do I validate 50k different third parties to say, sure, they can
> send with gmail.com.
>
> And it also won't help when someone creates yet another domain and now I
> need 50001 records.
>
> Every Google Apps domain has mailing lists (Google Groups) support, should
> I put all of them automatically on such a list?  That's way more than 50k
> records at that point, and even if they're paying me (Google) money, I
> don't know if I would trust them to send from gmail.com or google.com.
> Currently, for sending mail as google.com, we require vendor level
> security audits... am I supposed to just say "ok" to every random mailing
> list that googlers are on?
>

This is precisely why I am "showing my disinterest in completing the DKIM
ATPS work", and also why I don't think things like DSAP or TPA will work
either.  They all amount to creating a registration burden on the author
domain, and those sorts of approaches do not scale.

Solutions to this problem have to be self-contained in order to stand a
chance of being viable.  The drafts before us now attempt to augment DKIM
in a way that doesn't create any extra queries to the DNS or any other
registry to validate.  So far, this seems way more palatable.

-MSK

v2.23.0 | Report a Bug | By Email