Subject: Re: [domainrep] I-D.*-reputation-*.01 (was: A document about reputation data meta-issues)

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 14 Mar 2012 19:31:27 +0000

Going back a ways...

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
> Sent: Tuesday, November 01, 2011 4:38 PM
> To: [email-masked]
> Subject: Re: [domainrep] I-D.*-reputation-*.01 (was: A document about reputation data meta-issues)
> 
> > It would be interesting to do an evaluation of if it really is
> > necessary.  At some level (and I know I'm generalizing here) both DKIM
> > validation and SPF pass results output a domain that the domain owner
> > have given some level of authorization to.
> >
> > I don't think it's at all clear that this distinction makes enough
> > difference to be worth the complexity associated with maintaining
> > multiple types of identity.
> 
> In general I agree that it's unclear.  What I expect, though, is that
> there will be purists out there that claim one is better than the other
> for whatever reason, and want to ensure that their mail flow is based
> on one in particular.  The IDENTITY stuff provides a way to confirm
> that in the reply to the query.
> 
> I think this is something useful to include initially.  If it turns out
> to be unused because the result is mainly the same on both "sides",
> then we can drop it in a later version (say, when it advances to draft
> standard).
> 
> Having said that, I'll see if I can produce some reports from the
> accumulated OpenDKIM data that confirm (or are unable to confirm) a
> strong correlation.  Perhaps others here have databases they could tap
> to do the same.

It looks like my accumulated data don't in fact have what it takes to do this correlation.  I hope someone else can.  In the absence of a general "it doesn't make a difference" statement, however, I think we still need this capability.  Even if we do get data that shows SPF and DKIM (for example) basically result in highly similar reputations, some third mechanism that's supported might not.

-MSK