3 ms·
A solution would be to extend SMTP with a new verb that allows specifying a domain-related signature prior to message delivery. This would be a hybrid of DMARC
by ttul 6y ago
A solution would be to extend SMTP with a new verb that allows specifying a domain-related signature prior to message delivery. This would be a hybrid of DMARC and SPF and would allow receivers to very the sender identity independent of the sending IP.
- jeffbee 6y agoThat still requires the actual sender (Google in this case) to possess the key material necessary to sign on behalf of the domain, which means you still have a "confused deputy" risk.
- ttul 6y agoThe sender could obtain that material from the message itself and could verify the veracity of the material against the keys stored in the DNS by the domain owner.