Re: Problems with SPF, solutions, and a timeline.

John Levine <[email protected]> wrote:
> I'd like to stop getting bounce messages, too, but it sounds like
> you're agreeing that LMAP schemes will not in fact deter any spam
> since spammers can easily evade it by using either their own throwaway
> domains or any of the millions of domains that will never publish LMAP
> records.

  The same argument can be applied to any proposed anti-spam system:
There are tens of millions of systems which will never publish
anti-spam information "foo", or will never clean the spam trojans off
their systems, or will never fix their open proxy, or will never do
anything.

  This sounds to me like an argument for throwing away SMTP entirely,
and starting over with perhaps a similar protocol on a different port,
but one which doesn't have SMTP's flaws.

> If so, why bother?  We should move directly to a signature scheme like
> domain keys in which each protected message makes a directly
> verifiable assertion that it's good,

  And the spammers will (of course) sign their own messages, so such
schemes are pointless, because all they do is make the recipient do
more work, with no long-term benefit.

  So... we should do nothing.

>  rather than an LMAP scheme where the message says nothing and you
> have to intuit the domain owner's intentions indirectly.

  I thought that LMAP was where the domain owner published his
intentions explicitly in LMAP.  Or am I wrong?

> Maybe it'll turn out that in fact one-way forwarders are too risky,
> and we'll all have to demand that they become two-way or die, but
> that's another cost that has to be made explicit if we're serious.

  Exactly.  Free forwarding servers will occur costs in *any*
anti-spam system which makes them accountable for the messages they
forward.  THis may mean that they charge for their services, or they
die.

  Life is imperfect, and no ones business model is guaranteed by law
to work forever.

  Alan DeKok.