Re: [mailop] unique/shared public DKIM keys per domain?

[Don Owens]

+1

Never assume that something doesn’t matter. It all depends on what the numbers 
say. The selector and other fields are features that can potentially be used to 
predict malicious or spammy behavior. I’m not aware of such a pattern yet for 
selectors, but it may very well be that there will be a set of best practices 
for selectors in the future, based on what we observe the bad guys do, as 
domain reputation becomes more prevalent.

./don


> On Oct 11, 2017, at 11:06, Luis E. Muñoz via mailop  wrote:
> 
> On 11 Oct 2017, at 6:31, John Stephenson wrote:
> 
> FWIW, maybe 5 years ago, we were required to send a legally mandated bulk
> email (deserving of delivery) and when reaching out to various inbox
> providers, my contact at yahoo suggested that I send this effort through an
> existing domain, but a unique selector. They didn't indicate exactly what
> this would do, but it does indicate that they are making use of the
> selector beyond it's original intended use, as Benjamin notes above.
> 
> To stress that, on this day and age, it's naïve to think that anything put on 
> an email, header or body, doesn't matter.
> 
> Best regards
> 
> -lem
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Luis E. Muñoz via mailop]

On 11 Oct 2017, at 6:31, John Stephenson wrote:

FWIW, maybe 5 years ago, we were required to send a legally mandated 
bulk

email (deserving of delivery) and when reaching out to various inbox
providers, my contact at yahoo suggested that I send this effort 
through an
existing domain, but a unique selector.  They didn't indicate exactly 
what

this would do, but it does indicate that they are making use of the
selector beyond it's original intended use, as Benjamin notes above.


To stress that, on this day and age, it's naïve to think that 
_anything_ put on an email, header or body, doesn't matter.


Best regards

-lem
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Benjamin BILLON via mailop]

> The statement was the selectors do not have an effect on reputation, but
that sometimes people believe they do because they changed the selector at
the same time they changed other things.
@Laura> that too; but there were clearly a possibility to say "no we don't
use s= at all", it hasn't been said.
A few years back, it was Yahoo saying that s= was part of the reputation.
Now to what extent, and is it still the case, I can't say.


-- 

Benjamin

2017-10-11 4:23 GMT+08:00 Brandon Long via mailop :

> Yeah, I'd echo a bunch of what Vladimir said, selectors are useful for
> different mail streams from the same domain, and we've played with using it
> for reputation (as a tuple with domain).  That said, we don't want to
> discourage rotation, especially not anything crazy like requiring senders
> to ramp a new selector/key, doing something crazy like using both keys at
> the same time and slowly replacing one with the other.
>
> Unfortunately, most folks don't seem to rotate very often (and Google as a
> sender isn't doing this well either), so we need to be careful.
>
> As long as it's a weak signal combined with others, it's probably fine.
>
> And, as always as a disclaimer, anything's fair game to change with no
> notice when we're staring down large new spammer campaigns.
>
> Brandon
>
> On Tue, Oct 10, 2017 at 11:00 AM, Laura Atkins 
> wrote:
>
>> On Oct 10, 2017, at 9:25 AM, Vladimir Dubrovin via mailop <
>> mailop@mailop.org> wrote:
>>
>>
>> I can say nothing about Google, but selectors can really have indirect
>> impact on the reputation.
>>
>> We do not bind reputation directly to objects like domains, selectors,
>> etc and use dynamic tuples instead (that is content of this tuple is
>> flexible to better match specific mailing type), and in many cases DKIM
>> selector is a member of this tuple, because it may  be useful to give
>> different reputation for different mail classes, e.g. marketing and
>> transactional from the same domain.
>>
>>
>> As I understand it, that’s outside the DKIM spec. However, that’s a
>> useful information, thank you.
>>
>> Also, it may be used within data feed to classifiers, and classifiers are
>> also used in reputation tuples and there is machine learning inside. So
>> it's really hard to predict how DKIM selector may affect reputation. But
>> surely, it can.
>>
>>
>> Thanks!
>>
>> laura
>>
>>
>> 10.10.2017 18:37, Laura Atkins пишет:
>>
>>
>> On Oct 9, 2017, at 8:15 PM, Benjamin BILLON via mailop 
>> wrote:
>>
>> Hi John,
>>
>> > Do you?
>> In the way I tried to express it, yes.
>> Gmail recently said that the selector, or the change of the selector, can
>> have a role in their anti-spam and reputation system. Just because it's an
>> element of the email, and that it can indicate something.
>>
>>
>> I think you misunderstood what was said. The statement was the selectors
>> do not have an effect on reputation, but that sometimes people believe they
>> do because they changed the selector at the same time they changed other
>> things.
>>
>> laura
>>
>> --
>> Having an Email Crisis?  800 823-9674 <(800)%20823-9674>
>>
>> Laura Atkins
>> Word to the Wise
>> la...@wordtothewise.com
>> (650) 437-0741
>>
>> Email Delivery Blog: http://wordtothewise.com/blog
>>
>>
>>
>>
>>
>>
>>
>>
>> ___
>> mailop mailing 
>> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>>
>> --
>> Vladimir Dubrovin
>> @Mail.Ru
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>>
>> --
>> Having an Email Crisis?  800 823-9674 <(800)%20823-9674>
>>
>> Laura Atkins
>> Word to the Wise
>> la...@wordtothewise.com
>> (650) 437-0741
>>
>> Email Delivery Blog: http://wordtothewise.com/blog
>>
>>
>>
>>
>>
>>
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Dave Warren]

On 2017-10-10 08:20, John R Levine wrote:

On Tue, 10 Oct 2017, David Hofstee wrote:
Didn't Google mention they wanted the age of the keys to count in the 
spam

score?


I'll check but I would be surprised if it made much difference.

I rotate my keys every month, which seems to be more often than anyone 
else in the world. and they like my mail just fine.


(Anecdote, not data.)

I was rotating very frequently at one point, daily or better, primarily 
for testing. Once it was working, it was scheduled daily for while, then 
monthly.


There was no notable impact when I started, nor when I stopped either.


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Brandon Long via mailop]

Yeah, I'd echo a bunch of what Vladimir said, selectors are useful for
different mail streams from the same domain, and we've played with using it
for reputation (as a tuple with domain).  That said, we don't want to
discourage rotation, especially not anything crazy like requiring senders
to ramp a new selector/key, doing something crazy like using both keys at
the same time and slowly replacing one with the other.

Unfortunately, most folks don't seem to rotate very often (and Google as a
sender isn't doing this well either), so we need to be careful.

As long as it's a weak signal combined with others, it's probably fine.

And, as always as a disclaimer, anything's fair game to change with no
notice when we're staring down large new spammer campaigns.

Brandon

On Tue, Oct 10, 2017 at 11:00 AM, Laura Atkins 
wrote:

> On Oct 10, 2017, at 9:25 AM, Vladimir Dubrovin via mailop <
> mailop@mailop.org> wrote:
>
>
> I can say nothing about Google, but selectors can really have indirect
> impact on the reputation.
>
> We do not bind reputation directly to objects like domains, selectors, etc
> and use dynamic tuples instead (that is content of this tuple is flexible
> to better match specific mailing type), and in many cases DKIM selector is
> a member of this tuple, because it may  be useful to give different
> reputation for different mail classes, e.g. marketing and transactional
> from the same domain.
>
>
> As I understand it, that’s outside the DKIM spec. However, that’s a useful
> information, thank you.
>
> Also, it may be used within data feed to classifiers, and classifiers are
> also used in reputation tuples and there is machine learning inside. So
> it's really hard to predict how DKIM selector may affect reputation. But
> surely, it can.
>
>
> Thanks!
>
> laura
>
>
> 10.10.2017 18:37, Laura Atkins пишет:
>
>
> On Oct 9, 2017, at 8:15 PM, Benjamin BILLON via mailop 
> wrote:
>
> Hi John,
>
> > Do you?
> In the way I tried to express it, yes.
> Gmail recently said that the selector, or the change of the selector, can
> have a role in their anti-spam and reputation system. Just because it's an
> element of the email, and that it can indicate something.
>
>
> I think you misunderstood what was said. The statement was the selectors
> do not have an effect on reputation, but that sometimes people believe they
> do because they changed the selector at the same time they changed other
> things.
>
> laura
>
> --
> Having an Email Crisis?  800 823-9674 <(800)%20823-9674>
>
> Laura Atkins
> Word to the Wise
> la...@wordtothewise.com
> (650) 437-0741
>
> Email Delivery Blog: http://wordtothewise.com/blog
>
>
>
>
>
>
>
>
> ___
> mailop mailing 
> listmailop@mailop.orghttps://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
> --
> Vladimir Dubrovin
> @Mail.Ru
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
> --
> Having an Email Crisis?  800 823-9674 <(800)%20823-9674>
>
> Laura Atkins
> Word to the Wise
> la...@wordtothewise.com
> (650) 437-0741
>
> Email Delivery Blog: http://wordtothewise.com/blog
>
>
>
>
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Laura Atkins]

> On Oct 10, 2017, at 9:25 AM, Vladimir Dubrovin via mailop  
> wrote:
> 
> 
> I can say nothing about Google, but selectors can really have indirect impact 
> on the reputation. 
> 
> We do not bind reputation directly to objects like domains, selectors, etc 
> and use dynamic tuples instead (that is content of this tuple is flexible to 
> better match specific mailing type), and in many cases DKIM selector is a 
> member of this tuple, because it may  be useful to give different reputation 
> for different mail classes, e.g. marketing and transactional from the same 
> domain.

As I understand it, that’s outside the DKIM spec. However, that’s a useful 
information, thank you. 

> Also, it may be used within data feed to classifiers, and classifiers are 
> also used in reputation tuples and there is machine learning inside. So it's 
> really hard to predict how DKIM selector may affect reputation. But surely, 
> it can.

Thanks!

laura 

> 10.10.2017 18:37, Laura Atkins пишет:
>> 
>>> On Oct 9, 2017, at 8:15 PM, Benjamin BILLON via mailop >> > wrote:
>>> 
>>> Hi John, 
>>> 
>>> > Do you?
>>> In the way I tried to express it, yes.
>>> Gmail recently said that the selector, or the change of the selector, can 
>>> have a role in their anti-spam and reputation system. Just because it's an 
>>> element of the email, and that it can indicate something.
>> 
>> I think you misunderstood what was said. The statement was the selectors do 
>> not have an effect on reputation, but that sometimes people believe they do 
>> because they changed the selector at the same time they changed other 
>> things. 
>> 
>> laura
>> 
>> -- 
>> Having an Email Crisis?  800 823-9674 
>> 
>> Laura Atkins
>> Word to the Wise
>> la...@wordtothewise.com 
>> (650) 437-0741   
>> 
>> Email Delivery Blog: http://wordtothewise.com/blog 
>>    
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> 
>> ___
>> mailop mailing list
>> mailop@mailop.org 
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop 
>> 
> 
> -- 
> Vladimir Dubrovin
> @Mail.Ru
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

-- 
Having an Email Crisis?  800 823-9674 

Laura Atkins
Word to the Wise
la...@wordtothewise.com
(650) 437-0741  

Email Delivery Blog: http://wordtothewise.com/blog  






___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Brandon Long via mailop]

The *.gappssmtp.com default DKIM signatures for GSuite domains are
currently all a single key, which would seem to say that we don't currently
think that blending keys is a bad thing.

That isn't to say it can't change in the future if there becomes a need, of
course.

Brandon

On Mon, Oct 9, 2017 at 10:04 AM, Alexander Burch 
wrote:

> Do major ISP check the public DKIM key for reputation metrics?
>
> For example, an ESP might use domain1.com, domain2.com and domain3.com to
> sign messages for different reputation pools.
>
> If these domains all have the same public DKIM key will this "blend" their
> reputations in any way, namely at Gmail? Will Gmail see the 3 domains use
> the same public key and link their reputations?
>
> Is there any advantage of using a unique public DKIM key for each domain
> to keep the reputations compartmentalized?
>
> Thanks,
> Alex
>
>
> Alex Burch
> ActiveCampaign / Deliverability Lead
> (800) 357-0402
> abu...@activecampaign.com
> 1 N. Dearborn St., Chicago , Il 60602, United States
> 
> 
> 
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Vladimir Dubrovin via mailop]

I can say nothing about Google, but selectors can really have indirect
impact on the reputation.

We do not bind reputation directly to objects like domains, selectors,
etc and use dynamic tuples instead (that is content of this tuple is
flexible to better match specific mailing type), and in many cases DKIM
selector is a member of this tuple, because it may  be useful to give
different reputation for different mail classes, e.g. marketing and
transactional from the same domain.

Also, it may be used within data feed to classifiers, and classifiers
are also used in reputation tuples and there is machine learning inside.
So it's really hard to predict how DKIM selector may affect reputation.
But surely, it can.

10.10.2017 18:37, Laura Atkins пишет:
>
>> On Oct 9, 2017, at 8:15 PM, Benjamin BILLON via mailop
>> > wrote:
>>
>> Hi John, 
>>
>> > Do you?
>> In the way I tried to express it, yes.
>> Gmail recently said that the selector, or the change of the selector,
>> can have a role in their anti-spam and reputation system. Just
>> because it's an element of the email, and that it can indicate something.
>
> I think you misunderstood what was said. The statement was the
> selectors do not have an effect on reputation, but that sometimes
> people believe they do because they changed the selector at the same
> time they changed other things. 
>
> laura
>
> -- 
> Having an Email Crisis?  800 823-9674 
>
> Laura Atkins
> Word to the Wise
> la...@wordtothewise.com 
> (650) 437-0741
>
> Email Delivery Blog: http://wordtothewise.com/blog
>
>
>
>
>
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop


-- 
Vladimir Dubrovin
@Mail.Ru

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[David Hofstee]

Didn't Google mention they wanted the age of the keys to count in the spam
score?

Old keys tend to have a longer timeframe to get stolen I guess. Maybe a
frequent key changes is an indicator of having good ops practices which
result in fewer incidents? Funny enough, I have only ever met one customer
that wanted to refresh its 1024 bit keys.

Yours,


David

On 10 October 2017 at 05:15, Benjamin BILLON via mailop 
wrote:

> Hi John,
>
> > Do you?
> In the way I tried to express it, yes.
> Gmail recently said that the selector, or the change of the selector, can
> have a role in their anti-spam and reputation system. Just because it's an
> element of the email, and that it can indicate something.
> It is not used for _reputation_ in its purest, simpliest form (value of d=
> is good, value of d=is bad), but it is one of the thousands thinks that
> might have a non-null, even if negligible, weight in the whole system.
> S, technically,an ISP's scientist or even just tech guy, won't say
> that these elements are not part of the reputation system. But the public
> should understand "nope, they're not".
> I don't know if the other main ISPs include s= or other things in their
> decision system, I believe they do. Maybe tomorrow they won't. And the day
> after tomorrow, they will again.
>
> That being said, the main point is that if you have deliverability issues,
> probably related to the reputation of a domain name, the incidence of s= or
> the public key are not the first things to worry about. Lack of consent,
> irrelevant content, bad list hygiene and too much communication pressure
> are by far the first causes of problems.
>
> Cheers,
>
>
> --
> 
> Benjamin
>
> 2017-10-10 10:56 GMT+08:00 John Levine :
>
>> In article 

Re: [mailop] unique/shared public DKIM keys per domain?

[Benjamin BILLON via mailop]

Hi John,

> Do you?
In the way I tried to express it, yes.
Gmail recently said that the selector, or the change of the selector, can
have a role in their anti-spam and reputation system. Just because it's an
element of the email, and that it can indicate something.
It is not used for _reputation_ in its purest, simpliest form (value of d=
is good, value of d=is bad), but it is one of the thousands thinks that
might have a non-null, even if negligible, weight in the whole system.
S, technically,an ISP's scientist or even just tech guy, won't say that
these elements are not part of the reputation system. But the public should
understand "nope, they're not".
I don't know if the other main ISPs include s= or other things in their
decision system, I believe they do. Maybe tomorrow they won't. And the day
after tomorrow, they will again.

That being said, the main point is that if you have deliverability issues,
probably related to the reputation of a domain name, the incidence of s= or
the public key are not the first things to worry about. Lack of consent,
irrelevant content, bad list hygiene and too much communication pressure
are by far the first causes of problems.

Cheers,


-- 

Benjamin

2017-10-10 10:56 GMT+08:00 John Levine :

> In article 

Re: [mailop] unique/shared public DKIM keys per domain?

[John Levine]

In article 

Re: [mailop] unique/shared public DKIM keys per domain?

[Benjamin BILLON via mailop]

ISPs might consider the change of s= or key as an element being part of
their reputation systems and metrics. The consequences are however unknown
but very most probably negligeable.
Considering that d= is the important stuff is right.
Having the same public key should not have any incidence, so if you witness
your "good" domain having decreasing performances, the problem most
probably lies in decreasing good behavior of the senders using it.



-- 

Benjamin

2017-10-10 1:55 GMT+08:00 Maarten Oelering :

> To my knowledge reputation is tied to the “d=“ domain. The value of the
> key is irrelevant with regards to reputation.
> Using shared or unique key pairs is a balance between managebility and
> security.
>
> Maarten
>
> On Mon, 9 Oct 2017 at 19:06, Alexander Burch 
> wrote:
>
>> Do major ISP check the public DKIM key for reputation metrics?
>>
>> For example, an ESP might use domain1.com, domain2.com and domain3.com
>> to sign messages for different reputation pools.
>>
>> If these domains all have the same public DKIM key will this "blend"
>> their reputations in any way, namely at Gmail? Will Gmail see the 3 domains
>> use the same public key and link their reputations?
>>
>> Is there any advantage of using a unique public DKIM key for each domain
>> to keep the reputations compartmentalized?
>>
>> Thanks,
>> Alex
>>
>>
>> Alex Burch
>> ActiveCampaign / Deliverability Lead
>> (800) 357-0402
>> abu...@activecampaign.com
>> 1 N. Dearborn St., Chicago , Il 60602, United States
>> 
>> 
>> 
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] unique/shared public DKIM keys per domain?

[Maarten Oelering]

To my knowledge reputation is tied to the “d=“ domain. The value of the key
is irrelevant with regards to reputation.
Using shared or unique key pairs is a balance between managebility and
security.

Maarten

On Mon, 9 Oct 2017 at 19:06, Alexander Burch 
wrote:

> Do major ISP check the public DKIM key for reputation metrics?
>
> For example, an ESP might use domain1.com, domain2.com and domain3.com to
> sign messages for different reputation pools.
>
> If these domains all have the same public DKIM key will this "blend" their
> reputations in any way, namely at Gmail? Will Gmail see the 3 domains use
> the same public key and link their reputations?
>
> Is there any advantage of using a unique public DKIM key for each domain
> to keep the reputations compartmentalized?
>
> Thanks,
> Alex
>
>
> Alex Burch
> ActiveCampaign / Deliverability Lead
> (800) 357-0402
> abu...@activecampaign.com
> 1 N. Dearborn St., Chicago , Il 60602, United States
> 
> 
> 
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] unique/shared public DKIM keys per domain?

[Alexander Burch]

Do major ISP check the public DKIM key for reputation metrics?

For example, an ESP might use domain1.com, domain2.com and domain3.com to
sign messages for different reputation pools.

If these domains all have the same public DKIM key will this "blend" their
reputations in any way, namely at Gmail? Will Gmail see the 3 domains use
the same public key and link their reputations?

Is there any advantage of using a unique public DKIM key for each domain to
keep the reputations compartmentalized?

Thanks,
Alex


Alex Burch
ActiveCampaign / Deliverability Lead
(800) 357-0402
abu...@activecampaign.com
1 N. Dearborn St., Chicago , Il 60602, United States



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop