Re: antiphishing idea

> I got the impression from the original that he was not doing that, and
> looking up the _whole_ Message-ID.

yes

> There's no easy transition either - you'd never know if whom you were
> doing these queries actually implemented this stuff, and NXDOMAIN could
> mean either "BAD! BAD! discard!" or "I don't implement that feature".

same as SPF and DKIM. They are more or less good if all implement them !

> It's trying to make "SPF -all" survive forwarding, but not as well as
> DKIM would (absent message mangulation).

DKIM is good for forwarding but it does not solve phishing !

> He's suggesting asking _both_ A and B.  So both paypal.com and
> example.com would have to say "Yup, I know that Message-ID".

yes, that is the idea. Already answered in previous mail

> So, you'd have to control example.com and have one (presumably recent)
> sample Message-ID from paypal.com, and you could send as many as you
> want with any contents you want.
>
> [Few (if any) MTAs enforce unique Message-IDs on inbound email.]

well...a good point to investigate

> Neither SPF or DKIM are perfect, but it behooves us to not try to
> bandaid their defects with something like this.  Patching a hole in a
> submarine with window screening comes to mind as a suitable analogy ;-)

ok, not bandaid.....let´s reinvent SMTP with 3 way handshake ! that is
a more suitable analogy for my idea !