On Dec 8, 2006, at 3:05 PM, Hector Santos wrote:
Blocking via policy definitely does _not_ offer much in the way
of protection, but will require a significant level of support
explaining why various messages are being rejected.
It will?
- A domain does not expect mail. Pretty good protection
- A domain requires mail to be sign. Pretty good protection
Only when message originators are recognized and verified by the MUA,
Nope, once again, MUA are not required. I can do the above easily
at the MDA.
Is viewing the display name protected by this effort?
Is receiving non-ASCII email-addresses protected by this effort?
Are look-alike and cousin-domains prevented?
What happens when a domain wishes to allow users use of a mailing-
list? Should they setup different domain names, or use a sub-
domain? How will increased domain names of the same entity better
allow a recipient to detect a spoof?
You can not offer "pretty good protection" at the MTA based upon
policy blocking. Simple schemes remain where your customers continue
to be spoofed. Annotation at the MUA can prevent these schemes,
works with non-ASCII email-addresses, prevents look-alike and cousin
domains exploits, and permits the use of mailing-lists without
additional domain names.
Policy based blocking is not a desirable feature when it will likely
make the situation worse at substantial costs to resources.
-Doug
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html
