Home page logo
/

nanog logo nanog mailing list archives

Re: gmail dropping mesages
From: Michael Thomas <mike () mtcc com>
Date: Tue, 26 Apr 2011 18:16:52 -0700

On 04/26/2011 05:08 PM, J.D. Falk wrote:
On Apr 25, 2011, at 10:12 AM, Jeff Mitchell wrote:

If you trust the issued certificates(!) being used to sign the mail, you at least have a good indication that the spam is 
coming from the domain that it says it's coming from. This can make spam blocking much more effective because instead 
of simply hoping that a domain-based blocklist will block spam and not ham (due to spoofed sender addresses), you have a 
pretty good feeling that this will be the case.

Of course this relies on various other bits and pieces to fall into place, such as properly handling such messages (Gmail's 
detection and handling rules aren't public AFAIK), CAs not being compromised, etc. Not to mention that the spammers can 
simply register another domain and buy a new cert -- but then the argument above still holds.
DKIM doesn't use purchased certificates.  It's all self-signed.

Well, they aren't self-signed either; DKIM doesn't use x.509
style certs at all. It's just RSAPublicKey DER-encoded public
keys that are placed in the DNS.

Mike, but it still requires some crufty ASN.1 which is prolly the
          confusion


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault