Comments on: Antispam spec sets off on path to standard

Yahoo, Cisco and partners have submitted DomainKeys Identified Mail, which helps verify the sender of a message, to a standards body.

[Bytesmiths]

YAY! ITEF Rocks!

Stamp out proprietary, controlled solutions!

Where can I sign up? I get THOUSANDS of spams a week!

[hadaso]

This is not an abti-spam technology

This is not an abti-spam technology. At most it can provide some protection to brand names. Spammers would be able to publish their own keys and authenticate their identity as domain owners, which has nothing to do with being able to tell if they are spammers or not, or to find out who they really are (other than the proud anonymous owners of a domain paid for by a credit card whose real owner has not yet found out was used to pay for a domain...)

[Bytesmiths]

YAY! ITEF Rocks!

Stamp out proprietary, controlled solutions!

Where can I sign up? I get THOUSANDS of spams a week!

[hadaso]

This is not an abti-spam technology

This is not an abti-spam technology. At most it can provide some protection to brand names. Spammers would be able to publish their own keys and authenticate their identity as domain owners, which has nothing to do with being able to tell if they are spammers or not, or to find out who they really are (other than the proud anonymous owners of a domain paid for by a credit card whose real owner has not yet found out was used to pay for a domain...)

[hadaso]

One major disadvantage compared to SPF

One major disadvantage compared to SPF is that Domain Keys requires that email headers be received before the sender's address can be authenticated, which is rather late in the process. SPF is better in that as soon as the sender's envelope address is given it can be authenticated, before any part of the message is passed. SenderID suffers from the same disadvantage.

And all of these systems suffer from the basic design, which is trying to authenticate the wrong data: the sender's alleged address. The only part of an email transaction that cannot be forged if the email transaction is to succeed is the recipient envelope address, and this is the data that should be used to authenticate that email received is wanted.

[hadaso]

One major disadvantage compared to SPF

One major disadvantage compared to SPF is that Domain Keys requires that email headers be received before the sender's address can be authenticated, which is rather late in the process. SPF is better in that as soon as the sender's envelope address is given it can be authenticated, before any part of the message is passed. SenderID suffers from the same disadvantage.

And all of these systems suffer from the basic design, which is trying to authenticate the wrong data: the sender's alleged address. The only part of an email transaction that cannot be forged if the email transaction is to succeed is the recipient envelope address, and this is the data that should be used to authenticate that email received is wanted.