RE: Domain reputation

> -----Original Message-----
> From: opendkim-users-bounce_at_lists.opendkim.org [mailto:opendkim-users-bounce_at_lists.opendkim.org] On Behalf Of Gary Mills
> Sent: Thursday, June 09, 2011 1:52 PM
> To: Murray S. Kucherawy
> Cc: opendkim-users_at_lists.opendkim.org
> Subject: Re: Domain reputation
>
> How many other groups are building reputation databases? I understand
> that Spamhaus was doing that. I know that DCC is doing that too. Do
> all these groups have any standards in common?

The specifications I've been working on say very specifically that they're limited to specifying how to ask the question and get an answer. In fact, the charter for the proposed working group says expressly that the "how" of computing reputation is off-topic. I think it's a "secret sauce" that can't possibly be specified in a standards document.

How one determines reputation in the human world varies from person to person. I think this should be mirrored in the technical solutions. For example, if I were to express a reputation about "example.com", I might give you a number, but you would hopefully want to know upon what that number is based before acting on it (unless your trust in me is enormous). The protocol is therefore extensible to be able to tell you things like "this value is based on DKIM" (versus some other message property) and also "this value is based on X data points".

I'm not too concerned about circular data, because it's perfectly legitimate to say "I give example.com a value of X based on its previous history of being associated with spammy messages." But the proposed system isn't limited to being used that way. We're planning to parameterize it, such as being able to ask "what do you think of X as it relates to Y" (e.g., "What do you think of email sent from Gary to Murray?").

As long as the consumer of the data understands how the result was computed and upon what it was based, I think it's a valuable system.

-MSK
Received on Thu Jun 09 2011 - 21:02:04 PST