Author Domain Signing Practices

The author address is the one specified in the {{samp|From}} header field defined in RFC 5322. In the unusual cases where more than one address is defined in that field, RFC 5322 provides for a {{samp|Sender}} field to be used instead.

The domains in 5322-From addresses are not necessarily the same as in the more elaborated Purported Responsible Address covered by Sender ID specified in RFC 4407. The domain in a 5322-From address is also not necessarily the same as in the envelope sender address defined in RFC 5321, also known as SMTP MAIL FROM, envelope-From, 5321-From, or {{samp|Return-Path}}, optionally protected by SPF specified in RFC 7208.

An Author Domain Signature is a valid DKIM signature in which the domain name of the DKIM signing entity, i.e., the d tag in the DKIM-Signature header field, is the same as the domain name in the author address.

This binding recognizes a higher value for author domain signatures than other valid signatures that may happen to be found in a message. In fact, it proves that the entity that controls the DNS zone for the author — and hence also the destination of replies to the message's author — has relayed the author's message. Most likely, the author has submitted the message through the proper message submission agent. Such message qualification can be verified independently of any published domain signing practice.

The practices are published in a DNS record by the author domain. For an author address {{samp|john.doe@example.com}}, it may be set as

{{sxhl|2=zone|1=

_adsp._domainkey.example.com. IN TXT "dkim=unknown"

}}

Three possible signing practices are provided for:

• unknown, which is the same as not defining any record, says the domain might sign some, most, or all email,
• all says all mail from the domain is signed with an Author Domain Signature,
• discardable says all mail from the domain is signed with an Author Domain Signature; furthermore, if such signature is missing or invalid, the domain owners want the receiving server to drop the message; that is, silently throw it away.{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2008q1/009557.html |title=discardable means discardable |author=John Levine |author-link=John Levine |date=23 February 2008 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=28 June 2010}}

The ADSP specification explicitly discourages publishing a record different from "unknown" for domains who have independent users and a usage policy that does not explicitly restrict them to sending mail only from designated mail servers, since mail sent independently of the organization will not be signed.[http://tools.ietf.org/html/rfc5617#appendix-B.5 rfc5617#appendix-B.5]

However explicitly that caveat is worded, it is not straightforward to understand the purpose and the limitations of ADSP. One of ADSP's authors holds that it is better to publish private lists of discardable domains, maintained by competent people, rather than letting each domain state their policy.{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2008q1/008985.html |title=1: 1 and assertions about third parties |author=John Levine |author-link=John Levine |date=17 January 2008 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=28 June 2010}}{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2010q2/013664.html |title=shared drop lists |author=John Levine |author-link=John Levine |date=2 June 2010 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=9 June 2010}} Recognizing that the spec has shipped an untested prototype, the author of a popular ADSP implementation has proposed to downgrade ADSP to experimental status.{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2010q2/013643.html |title=the danger of ADSP, was list vs contributor |author=Murray S. Kucherawy |author-link=Murray Kucherawy |date=2 June 2010 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=9 June 2010 |archive-url=https://web.archive.org/web/20160309073840/http://mipassoc.org/pipermail/ietf-dkim/2010q2/013643.html |archive-date=9 March 2016}} Later on, it was actually downgraded to historical. The consideration that DMARC covers more or less the same use case was influential, but not tied in.{{cite web |url=http://www.ietf.org/mail-archive/web/ietf/current/msg82823.html |title=How to protect DKIM signatures: Moving ADSP to Historic, supporting DMARC instead |author=Barry Leiba |date=3 October 2013 |website=IETF Discussion List |publisher=IETF |accessdate=26 November 2013}}

For some time ADSP was known as ASP (Author Signing Practices),{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2008q1/009316.html |title=Draft of ASP, Author Signing Policy |author=John Levine |author-link=John Levine |date=31 January 2008 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=24 June 2010}} or the original SSP (Sender Signing Practices), until a protocol naming poll.{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2008q2/009866.html |title=Practices protocol naming poll (Closing issue 1550) |author=Stephen Farrell |date=4 April 2008 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=24 June 2010}}

Domainkeys, DKIM's predecessor, had an Outbound Signing policy consisting of a single character, "-" if a domain signs all email, and "~" otherwise.RFC 4870, Section 3.6 Policy Statement of Sending Domain. DKIM intentionally avoided signers' policies considerations, so that DKIM does not validate a message's "From" field directly, but is a policy-neutral authentication protocol. The association between the signer and the right to use "From", a field visible to end users, was deferred to a separate specification.{{cite web |url=http://mipassoc.org/pipermail/ietf-dkim/2005q3/000047.html |title=DKIM Threat Assessment v0.02 (very rough draft) |author=Eric Allman |author-link=Eric Allman |date=9 August 2005 |work=IETF DKIM Discussion List |publisher=mipassoc |accessdate=24 June 2010}}

Eric Allman, the author of Sendmail, was an editor of the ADSP specification for the IETF DKIM Working Group.

The draft ADSP specification started in June 2007 and went through 11 revisions and lengthy discussion before being published as RFC in August 2009 - but was declared "Historic" four years later in November 2013 after "...almost no deployment and use in the 4 years since..."

• DKIM
• DMARC
• SMTP
• Phishing
• E-mail authentication

{{Reflist}}

• [http://tools.ietf.org/html/rfc5617 DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP)]
• [http://tools.ietf.org/wg/dkim IETF DKIM working group] (started 2006)
• [http://www.dkim.org/ Domain Keys Identified Mail (DKIM)]

Category:Email authentication