The gap

Gentlemen,

I'd like to address a problem which all of our proposals have 
in common (I'm currently working on an article for a german 
magazine about information and communication law, that's why
I'm currently thinking about this problem):

Imagine we have such a mechanism to verify the 
sender address or its domain part based on information given
in this domain's zone table, and the whole world has adopted 
the mechanism. Will this stop spam? No. It will change the
flavour of spam. Spam will not come from @hotmail.com, @yahoo.com, 
@microsoft.com, but from domains like @example123.xy , and the
authorization records will cover the sender, thus making the 
mechanism accept the mail. 

How do we have to cope with this?

Our mechanism can be only the first link in a chain. We do not claim
that our mechanisms block spam, we claim that our mechanims provide a 
way to verify that the sender was authorized by the domain owner to do
so. Unfortunately, there are plenty of bulk domains just existing for 
commercial abuse. Many countries, including the USA, allow to provide
domains without any or without an obvious link to the person
responsible for that domain. If the spammer is identical with that 
particular domain owner - boom. So once our mechanism as reliably 
verified, that the domain authority - whatever this might be - had 
authorized the sender, the next link in the chain must follow. 
Since this is still a weak point of all our proposals, we should 
at least think about this.

>From my experience, the best way to perform the next step would be 
to perform a whois query on that domain and to decide whether we
do accept mails from it or not.

Problems:

- whois is slow

- whois is not highly available. If every MTA started to query 
  whois servers, they'd go down.

- many domains don't have proper whois entries

- there is no standard format for whois entries, trying to parse
  whois-entries is a mess.

- whois often does not provide the information we'd like to see



Our mechanism as the first link of the chain would solve many, 
but not all problems needed to get rid off to cope with spam.

A "solution" would be to formulate requirements for future
whois-services and send them to ICANN (and pray). I'd like to 
see the following informations:

- XML for easy parsing
- which legislation does this domain (or its responsible authority 
  belong to)
- private person, company, anonymous
- long-time or short-time domain
- Who sold the domain
- abuse contact address
- ...

based on these informations the MTA would have to decide whether 
to accept messages from this domain or not. There can be a long-time
cache. I guess caching intervals of 1-3 months would not really be a
problem. 

Opinions?


regards
Hadmut