1. A Retrospective on Future Anti-Spam Standards Internet Society of China Beijing – September, 2004 Dave Crocker Brandenburg InternetWorking <http://brandenburg.com/current.html> Internet Society of China Beijing – September, 2004 Dave Crocker Brandenburg InternetWorking <http://brandenburg.com/current.html>

2. 2 2 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 Retrospective on the Future  Spam is complex, confusing and emotional  Imagine that time has passed  What changes will be important?  Email  Will it still be easy to reach everyone?  Will it be cumbersome, with fragmented communities?  Spam  Legitimate business will behave acceptably (mostly)  Rogue (criminal) spammers will be worse than today  Spam is complex, confusing and emotional  Imagine that time has passed  What changes will be important?  Email  Will it still be easy to reach everyone?  Will it be cumbersome, with fragmented communities?  Spam  Legitimate business will behave acceptably (mostly)  Rogue (criminal) spammers will be worse than today

3. 3 3 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 Security Functions TermFunction Identification Who does this purport to be? Authentication Is it really them? Authorization What are they allowed to do? Accreditation What do I think of the agency giving them that permission?

4. 4 4 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 What Will Be Standard?  Accountability (Author & Operator)  Authentication  Authorization  Reputation  Filtering  Format of rules  Accountability (Author & Operator)  Authentication  Authorization  Reputation  Filtering  Format of rules  Reporting & monitoring  Immediate problems  Aggregate statistics  Enforcement (Contracts and laws are standards)  Terminology  Acceptable behavior

5. 5 5 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 Email Path(s) Today! MUA MSAMTA MDA MUA MTA Peer MTA MTA MDA MUA Mail Agents MUA = User MSA = Submission MTA= Transfer MDA= Delivery

6. 6 6 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 SPF and Sender-ID: Author Path Registration oMUAMSA MTA 1 MTA 4 MDArMUA MTA 3 MTA 2 Peer MTA Assigns Sender & MailFrom Did MSA authorize MTA 1 to send this message ? Did MSA authorize MTA 2 to send this message ? Did MSA authorize MTA 3 to send this message ? 1.Authority and Accreditation of MSA and MSA domain administrators 2.MSA must pre- register and trust each MTA in path

7. 7 7 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 My Personal Favorites  Validate content  DomainKeys  Public key signature of the message  Validate operator  CSV  Operator validates MTA  [Validate MailFrom]  [BATV]  Validate content  DomainKeys  Public key signature of the message  Validate operator  CSV  Operator validates MTA  [Validate MailFrom]  [BATV]  Reputation  CSA & DNA (CSV)  Reporting  No candidates, yet  Enforcement  We are still learning

8. 8 8 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 Client SMTP Validation: Assess Peer MTA MUAMSAMTA MTAMDAMUA MTA MTA Peer MTA Does a domain's operator authorize this MTA to be sending email? Do independent accreditation services consider that domain's policies and practices sufficient for controlling email abuse?

9. 9 9 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 CSV Functions TermFunctions Identification Client SMTP HELO domain name Authentication Domain name lists IP Address Authorization Name is authorized to be MTA Accreditation  Name may point to accreditors  Accreditors may list domains

10. 10 D. Crocker, Brandenburg InternetWorkingISOC China – Beijing,Saeptember 2004 How to Choose the Future  Look at each choice  Who must adopt it? When?  How much effort is need to administer it?  How much does it change email?  Look at each choice  Who must adopt it? When?  How much effort is need to administer it?  How much does it change email? Xie Xie