[DNSOP] Re: [art] Re: DNS-designated Public Key Author ities (DKA)

On Thu, Jun 25, 2026 at 2:57 PM John Levine <[email protected]> wrote:
...
> At a lot of organizations the people who run the mail and the people who run the
> website do not talk to each other. So if you want to publish key info for
> [email protected] ... you would often be told to
> forget it.

Dynamic integration between the email account database and the web
serving could be difficult, sure, but that's not what we're talking
about here.  All we need is a static JSON file at
./well-known/dka.json that says {"dka-url":
"https://dka-provider.example/"}.  Even a pretty disorganized
operation should be able to manage that.

...
> While an SMTP extension is a technical possibility, in practice, again forget it.  SMTP has
> a VRFY command that you have probably never heard of which is intended to let you check if
> a mail address exists.  Spammers discovered it about 30 years ago to harvest mail addresses,
> and everyone turned it off.  A key server extension would be similarly unpopular.

We are starting from the assumption that the SMTP server operator
_wants_ to announce a key distribution server.  So why wouldn't they
want to announce that server over SMTP?

This approach doesn't require the key _lookup_ to occur over SMTP.
Key lookup can (potentially) use a different server and a different
protocol.

> So I guess the mta-sts like hack is a possibility, but I would think hard about how you
> are going to make it usable without also making it an attractive nuisance.

Choosing a fixed subdomain is also possible I guess.  I don't see why
it's preferable over .well-known though.

--Ben

_______________________________________________
DNSOP mailing list -- [email protected]
To unsubscribe send an email to [email protected]