1. DNS-based Message-Transit Authentication Techniques D. Crocker Brandenburg InternetWorking D. Crocker Brandenburg InternetWorking

2. 2 2 D. Crocker DNS-based Authentication Techniques What we will cover…  Ein kleine email background  Evaluating anti-spam proposals:  Authentication proposals  Content vs. Operations  Permit Ops Admin to enforce accountability  Strengths and weaknesses  Current status  Ein kleine email background  Evaluating anti-spam proposals:  Authentication proposals  Content vs. Operations  Permit Ops Admin to enforce accountability  Strengths and weaknesses  Current status

3. 3 3 D. Crocker DNS-based Authentication Techniques Setting the Context © 1975(!) Datamation This? Oh, this is the display for my electronic junk mail.

4. 4 4 D. Crocker DNS-based Authentication Techniques Email has Become Complicated… Mail Handling Service (MHS) MTA MSA MTA MDA MDA MTA MDA MTA MTA MDAMSA MTA Mediator MUA MUA MUA MUA MUA MUA Bounce MUA: User Agent Mediator: User- level Relay MHS: Mail Handling (transit) Service MSA: Submission MTA: Transfer MDA: Delivery Bounce: Returns

5. 5 5 D. Crocker DNS-based Authentication Techniques More Than One “Sender” MTAMTAMTAMTA MUA MDAMSAMDA Mailing List  MTA IP  rfc2821.HELO  Provider Network IP  rfc2822.Sender  rfc2822.From  rfc2821.MailFrom (Bounce/Return-Path, set by rfc2822.Sender)  rfc2821.Received  rfc2822.Sender MSA MTA Bounce

6. 6 6 D. Crocker DNS-based Authentication Techniques Trust Boundaries AE 1 AE 5 AE 3 AE 2 AE 6 AE 4 AE 7 MUAMUA MUA MTA MSA MTA MDA Mediator MDAMSA MTA MUA MTA1 MDA AE: Administrative Environment

7. 7 7 D. Crocker DNS-based Authentication Techniques Content analysis (eg, Bayesian) vs. Accountability, composed of: Content analysis (eg, Bayesian) vs. Accountability, composed of: AccountabilityAccountability Identity Who does this purport to be? (IP Address or Domain Name) Authentication Is it really them? Authorization What are they allowed to do?Assessment What do I think of the agency giving them that permission? (e.g., Reputation or Accreditation)

8. 8 8 D. Crocker DNS-based Authentication Techniques Address Registration Schemes NameIDDNS RRPurpose Sender Policy Framework ( SPF ) schlitt-spf-classic  rfc2821.MailFrom  rfc2821.Helo SPF or TXT V=spf1 Register client MTA with MailFrom domain. “Owners authorize hosts to use their domain name in the MAIL FROM or HELO “ Sender-ID ( SID ) lyon-senderid-core  rfc2822.Sender  rfc2821.MailFrom SPF or TXT v=spf1, v=spf2 Register client MTA with Sender domain. “Does SMTP client have permission from referenced mailbox?” Certified Server Validation (CSV) mipassoc.org/csv  rfc2821.HeloA Register client MTA domain of ops. “Permits SMTP server to decide whether SMTP client is likely to produce well-behaved traffic”

9. 9 9 D. Crocker DNS-based Authentication Techniques Signature-based Schemes NameIDDNS RRPurpose Domain Keys Identified Mail (DKIM) Mipassoc.org/dkim Independent (!) (usually tied to rfc2821.Sender) TXT Sign message+headers. “Domain owners may authorize hosts to use their domain name in the MAIL FROM or HELO “ Bounce Address Tag Validation (BATV) Mipassoc.org/batv Rfc2821.MailFromNone required Sign MailFrom “Defines an extensible mechanism for validating the MailFrom address”

10. 10 D. Crocker DNS-based Authentication Techniques Strengths and Weaknesses SchemeStrengthsWeaknesses SPF  No client-side software  Limits transit sources, paths  Admin & DNS query overhead  RR complexity SID  No client-side software  Mostly same as SPF  IPR (Microsoft) CSV  Simple, direct, complete  No traction DKIM  Not sensitive to path, source  Software changes  Signature fragility BATV  Does not require interoperability  No traction  Some MLs break

11. 11 D. Crocker DNS-based Authentication Techniques IETF Status SPF: SPF: WG dead due to lack of rough consensus; “Experimental” status stalled on appeal, due to RR version conflict with SID SID: SID: Same as SPF CSV: CSV: Stalled DKIM: DKIM: WG forming; delayed for “threat analysis” BATV: BATV: Stalled SPF: SPF: WG dead due to lack of rough consensus; “Experimental” status stalled on appeal, due to RR version conflict with SID SID: SID: Same as SPF CSV: CSV: Stalled DKIM: DKIM: WG forming; delayed for “threat analysis” BATV: BATV: Stalled