3 ms·

That proves I own the domain to some extent. Don't DKIM records do the same? For the purposes of anti-spam, a cert doesn't do anything except prove that you s

That proves I own the domain to some extent. Don't DKIM records do the same? For the purposes of anti-spam, a cert doesn't do anything except prove that you showed some CA that you own the domain (which can be done and is done in other ways currently).

grey-area 11y ago
At present SMTP is so broken that arbitrary servers are allowed to send mail for any domain, with fake headers, there is no proper verification of sending server or sending identity, the mail is accepted (along with legitimate mail), and put in spam folders (sometimes, as is real mail sometimes). SPF/DKIM are an attempt to solve that of course, but they are not enforced rigorously or universally, and tactics like IP reputation and email content sniffing still seem to be widely used too (the problem reported in the article). Compared to the web, email seems pretty behind on verifying server identity.
- jimktrains2 11y ago
  Yes, that's my point. It doesn't really solve any issues that SPF/DKIM don't already solve -- pointing to certs isn't a new solution, it's a rehash of the same solution. And yes, the concept of relays should disappear along with much of the other cruft SMTP brings. (And while we're at it, can we fix/replace IMAP, or at least make the spec say that message ids are eternal and can't be invalidated?)
  - grey-area 11y ago
    IMO Message ids should be defined as a sha512 of headers and content to ensure they are unique. A new protocol is required.
    - jimktrains2 11y ago
      Currently headers get modified in-flight, so a content-based ID wouldn't work. As for a new protocol, there are some out there, but all fail in some way or another. I figured I'd throw my ideas out there and see how much they fail https://github.com/jimktrains/email_ng https://github.com/jimktrains/email_ng
zokier 11y ago
EV certificates are to be bit more extensive than just proving ownership of domain. Most importantly they should associate the owner with some legal entity. So using EV certs would force spammers to establish shell companies, which typically is bit more expensive than just buying a domain and leaves stronger paper trail.

grey-area 11y ago

At present SMTP is so broken that arbitrary servers are allowed to send mail for any domain, with fake headers, there is no proper verification of sending server or sending identity, the mail is accepted (along with legitimate mail), and put in spam folders (sometimes, as is real mail sometimes). SPF/DKIM are an attempt to solve that of course, but they are not enforced rigorously or universally, and tactics like IP reputation and email content sniffing still seem to be widely used too (the problem reported in the article). Compared to the web, email seems pretty behind on verifying server identity.

jimktrains2 11y ago
Yes, that's my point. It doesn't really solve any issues that SPF/DKIM don't already solve -- pointing to certs isn't a new solution, it's a rehash of the same solution. And yes, the concept of relays should disappear along with much of the other cruft SMTP brings. (And while we're at it, can we fix/replace IMAP, or at least make the spec say that message ids are eternal and can't be invalidated?)
- grey-area 11y ago
  IMO Message ids should be defined as a sha512 of headers and content to ensure they are unique. A new protocol is required.
  - jimktrains2 11y ago
    Currently headers get modified in-flight, so a content-based ID wouldn't work. As for a new protocol, there are some out there, but all fail in some way or another. I figured I'd throw my ideas out there and see how much they fail https://github.com/jimktrains/email_ng https://github.com/jimktrains/email_ng

zokier 11y ago

EV certificates are to be bit more extensive than just proving ownership of domain. Most importantly they should associate the owner with some legal entity. So using EV certs would force spammers to establish shell companies, which typically is bit more expensive than just buying a domain and leaves stronger paper trail.