Author Domain Signing Practices

In computing, Author Domain Signing Practices (ADSP)
is an optional extension to the DKIM E-mail authentication
scheme, whereby a domain can publish the signing practices it adopts when relaying mail on behalf of associated authors.

ADSP was adopted as a standards track RFC 5617 in August 2009, but declared "Historic" in November 2013 after "...almost no deployment and use in the 4 years since...".

Concepts

Author address

The ''author address'' is the one specified in the header field defined in RFC 5322. In the unusual cases where more than one address is defined in that field, RFC 5322 provides for a field to be used instead.

The domains in 5322-''From'' addresses are not necessarily the same as in the more elaborated ''Purported Responsible Address'' covered by Sender ID specified in RFC 4407. The domain in a 5322-''From'' address is also not necessarily the same as in the ''envelope sender'' address defined in RFC 5321, also known as SMTP MAIL FROM, envelope-''From'', 5321-''From'', or , optionally protected by SPF specified in RFC 7208.

Author Domain Signature

An ''Author Domain Signature'' is a valid DKIM signature in which the domain name of the DKIM signing entity, i.e., the d tag in the ''DKIM-Signature'' header field, is the same as the domain name in the author address.

This binding recognizes a higher value for author domain signatures than other valid signatures that may happen to be found in a message. In fact, it proves that the entity that controls the DNS zone for the author — and hence also the destination of replies to the message's author — has relayed the author's message. Most likely, the author has submitted the message through the proper message submission agent. Such message qualification can be verified independently of any published domain signing practice.

Author Domain Signing Practices

The practices are published in a DNS record by the author domain. For an author address , it may be set as

Three possible signing practices are provided for:
* unknown, which is the same as not defining any record, says the domain might sign some, most, or all email,
* all says all mail from the domain is signed with an Author Domain Signature,
* discardable says all mail from the domain is signed with an Author Domain Signature; furthermore, if such signature is missing or invalid, the domain owners want the receiving server to drop the message; that is, silently throw it away.

Caveat

The ADSP specification discourages publishing any record other than "unknown" for domains with independent users and no strict policy to send mail only via designated servers, since such mail would not be signed.

Even so, its purpose and limitations are not always clear. One of ADSP's authors argued it's better to maintain private lists of ''discardable'' domains, managed by trusted parties, than to have each domain declare its own policy. Acknowledging that the spec was essentially an untested prototype, the author of a popular ADSP implementation proposed downgrading it to ''experimental'' status. It was eventually reclassified as ''historical'', partly because DMARC covered a similar use case.

History

For some time ADSP was known as ASP (Author Signing Practices), or the original SSP (Sender Signing Practices), until a protocol naming poll.

DomainKeys, DKIM's predecessor, had an ''Outbound Signing policy'' consisting of a single character, "-" if a domain signs all email, and "~" otherwise. DKIM intentionally avoided signers' policies considerations, so that DKIM does not validate a message's "From" field ''directly'', but is a policy-neutral authentication protocol. The association between the signer and the right to use "From", a field visible to end users, was deferred to a separate specification.

Eric Allman, the author of Sendmail, was an editor of the ADSP specification for the IETF DKIM Working Group.

The draft ADSP specification started in June 2007 and went through 11 revisions and lengthy discussion before being published as RFC in August 2009 - but was declared "Historic" four years later in November 2013 after "...almost no deployment and use in the 4 years since..."

See also

*DKIM
*DMARC
*SMTP
*Phishing
* E-mail authentication

References

{{Reflist

External links

DomainKeys Identified Mail (DKIM) Author Domain Signing Practices (ADSP)

IETF DKIM working group
(started 2006)

Domain Keys Identified Mail (DKIM)

Email authentication