X-ASVP Executive Overview eXtensible Anti-spam Verification Protocol X-ASVP Committee Technical Working Group July 25, 2007

Agenda Uses for X-ASVP How X-ASVP works X-ASVP Process flow URL “search path” algorithm Meta-document example Implementation Overhead

Uses for X-ASVP Distributed Do Not Registry – Indicate “opt-out” as defined in CAN-SPAM Act – Would give ISP’s new legal standing and toolset to pursue spammers Public Key Infrastructure – Would be a common location to post public keys Authentication token (Level 1: ASVP-WEB) – Could be used to enforce authentication to a web server prior to accepting

How X-ASVP works Defines a set of web addresses associated to an e- mail address – One at the domain of the address – One at the host “ in the same top level domain (.com,.net,.org, etc. ) as the addresswww.x-asvp – One at the protocol committee’s website Defines syntax for posting user information at one (or more) of the above web addresses.

X-ASVP Process Flow Recipient posts an X-ASVP “meta- document” sender collects recipient preferences from the posted meta-document – Bulk mail ( “legal” senders will respect UCE setting; those who don’t violate CAN-SPAM ) – PGP ( public key available on meta-document ) – ASVP-WEB ( “token” included in mail header )

X-ASVP URL Algorithm Goals: Distributed, Redundant, Universal Hosts: 1. the domain, 2. top level domain, 3. global Rules: 1. All alpha converted to uppercase, 2. non-alpha numeric converted to underscore Example: – – –

Meta-document example Token for Level 1 “ASVP-WEB” extension Do Not “Registration” Asymmetric encryption public key

Solution Data Flow

Implementation Overhead For an ISP or Enterprise that already runs a web server, implementation can be trivial – DNS record (CNAME) for “x-asvp” host – Virtual Host on existing web server – Generic page script (example on x-asvp.org )

Benefit of “trivial” implementation Equivalent to posting “No Trespassing” on your Inbox. – If recognized as equivalent to listing in “National Do Not E- mail Registry”, then enforcement provisions of CAN-SPAM apply. Spammers don’t know whether or not you’re filtering on the ASVP-WEB token provided. – New anti-spam toolset 1. IP address trail available when tokens are collected. 2. CGI script logic easier to implement (for token generation) than sender host verification at MTA.