Yahoo Submits DomainKeys Draft To IETF

NetWizard writes "According to a mailing list post at the IETF, Yahoo's website and a Wired News story, Yahoo has made the DomainKeys draft public and submitted to the IETF." Russ Nelson explains "Basically, your MTA uses RSA-SHA1 to sign the headers and body of your email and inserts that signature before sending the email. The recipient MTA looks up $selector._domainkey.$domain in the DNS, gets your public key, verifies it, and inserts a notice. There's also a SourceForge project for a DomainKeys library." An anonymous reader asks "It seems to me that it doesn't offer anything more than the Sender Policy Framework by pobox.com, other than doing relay-based signing of the messages to provide the sender verification. SPF has already grown to over 14,000 domains so far and only requires an addition to your DNS to support (from the sending side). Verifying messages on the receiving MTA is as simple as doing a DNS lookup, most MTAs can support SPF now, the code is available and well tested. What advantages to people see in Domainkeys over SPF that are actually useful, and what standard should people implement?"

Comments

its a start

[josepha48]

Basically this sounds like it will require that the @foo.com domain to actually exist. Unfortunately this does pose a few questions. 1) If a dns lookup fails, will the message get sent or held. 2) Will it be able to prevent valid domains from sending spam? No.

I get email that is addressed @mindspring.com or @yahoo.com so the domains are already valid domains that they are coming from. In most cases not all. So this will reduce spam, but not eliminate spam. Not sure what the real solution is, because spam filtering is not working when they start sending crap words through email that dont mean anything. What's with the pr0n and pn31s crap in the subject line. Yeah okay so your spam reached its destination without being filtered. Maybe the subject line was looked at, but it was most likely deleted.