Re: [dmarc-ietf] what's a list

["John Levine" <[e-mail]>]

>Most of the current deployment is at large providers that can do significant 
>data analysis to effectively identify lists.  As a small domain, there's no way 
>I can do the same.
>
>If there were a protocol method to share this information, either among 
>trusted receivers or via 'hints', it could be useful to smaller providers that 
>don't have the scale to mine the data themselves.

That's the kind of thing that VBR is intended for.  A trusted party
publishes a list of certified domains in the DNS.  When you get a
message, you look up the authenticated domain (DKIM valid d= or SPF
mail from pass) in the VBR list, and if it's there, it's certified.

The mechanism is trivial.  The hard parts are collecting the set of
trustworthy sending domains, and arranging for someone credible to
publish it.