Re: Macro payments through domain names?

[email protected] wrote:

> Put the hash (eg., md5) of a public pgp/gpg key used for signing
> emails in a DNS entry derivable from the email address. Enforce the
> DNS lookup to be in two steps. The first lookup returns the reference
> to an external top level domain; the 'eMail Authorization Domain'
> (mad). The second lookup is a TXT query towards this 'mad' which must
> return the hash of the public key of the email signature (where the
> public key and the signature data is included in the end of the email
> as usual).
> 
> Now use a system of blacklists similar to how it works today, but for
> sent spam, blacklist the involved 'mad' instead of the domain of the
> sending email address. This makes a 'mad' used for spamming
> "unusable" for further emailing, and someone will have to pay for a
> new domain that isn't yet on the blacklists; but when doing so one
> will be able to keep using the same email address as before (which is
> important if some other user under your domain was responsible for
> the spamming).

I was thinking of something only a little different; you get to buy
(rent ?) a  key that's good for N emails/month.  This does mean that
a counting service would be needed, which would count reported email
receipts for each key.

Exceeding the purchased rate *automatically* blacklists the key for the rest 
of the hour/day/month -- so it provides throttling against even unintentional
excessive emailing.

That way, anyone who wants to run their own mail service can buy (rent?)
a key, and ISP's could build the cost of key rental for their clients
into the service agreement price.

To prevent false reporting of delivered email (which could otherwise allow
a denial of service attack) the sender would need to send in a
(message-id, recipient) list to the counting service (signed).
The recipient report would then be checked against the pending 
message-id,recipient pair, and the mail count would be updated.

> Spammers paying for their own 'mad's will have a hard time to make
> profit, and will be traceable by whois data. Spammers using hacked
> systems will really push people towards higher computer security
> since such incidents now leads to a real monetary cost. However, the
> actual cost will hardly drive anyone out of business, since it can
> be limited to the registration fee of one domain per organization.

If your system is hacked; you could pay a key-replacement fee, and
get a new key issued.