Spam’s New Nemesis: ‘Trust-Based’ Messages

Investors Business Daily, publica un interviu cu David Crocker, (Principal BrandenBurg InternetWorking - autorul a numeroase RFC-uri, implicat in standardizarea emailului inca din anii ‘70), legat de noile standarde propuse spre adoptie:

IBD: Where does the war on spam stand right now?

Crocker: Spam is merely another example of social misbehavior. It’s not likely to go away, and all we can do is bring it down to tolerable levels.

IBD: What’s your solution?

Crocker: You have to create what I call a trust overlay to the existing e-mail system. Existing senders and receivers can continue to use e-mail as before. All we’re doing is adding a mechanism that lets them trust who mail is from and (determine) whether that sender is trustworthy.

IBD: How is trust defined?

Crocker: Trust is based on whether the identification (used in the e-mail) is accurate — if it’s from who it says it’s from. The other requirement is that the person or organization is trustworthy.

IBD: How does it work?

Crocker: It’s a mechanism that requires an organization to attach a domain name to the message in a way that lets the recipient verify it. Domain names are things we use to get to Web pages or receive an e-mail address. It’s a tried-and-true technology that doesn’t require changing the entire e-mail system.

IBD: Why is adding a special domain name important in identifying whether an e-mail message is wanted or not?

Crocker: Existing “reputation” based e-mail screening systems are based on very low-level addressing numbers that say where a server is attached to the Internet, rather than what organization is sending the message. DKIM will identify the sender.

Interviul complet il puteti gasi aici

David afirma ca in prezent reputatia se bazeaza doar pe IP-uri ceea ce este nu foarte adevarat, deoarece unul din serviciile de reputatie a lansat in urma cu ~3 luni primul sistem de monitorizare a reputatiei la nivel de domeniu…nu doar IP. Oricum DKIM nu este singurul mecanism de autentificare care identifica domeniul de trimitere…aceasta se intampla si cu SPF. Ceea ce face in plus DKIM, este faptul ca stabileste o legatura intre organizatia care trimite mesajul si contentul acestuia. Acesta ar face mecanismul mai flexibil decat SPF in cazul forwardarilor.

In plus mai este o idee legata de marcarea emailurilor de la first time sender care nu prea au cum sa fie livrate automat in inbox pentru ca daca nu am comunica niciodata cu cineva…chiar daca am emailurile semnate cu DKIM, nu am nici un fel de reputatie in fata celor carora le trimit emailuri…si atunci ei vor fi nevoiti sa ma verifice..sa-mi verifice reputatia.