<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Totally agree with you there, I run a mail server/monitoring server on OVH. With TLSA records, DKIM, and MTA-STS, I’ll still see junk filters on it if I accidentally email someone other than myself. Yes my space has been SWIP’d and I send so low email volume so it’s reputation would be neutral at best which very much justifies the spam filters due to OVH’s reputation. Somehow I don’t think SHAKEN/STIR would be any different.<div class=""><br class=""></div><div class="">I wonder how far this would go on VoIP transit. I purchase from <a href="http://voicetel.com" class="">voicetel.com</a> for my house, which purchases from some other providers, which probably aggregates to others. It doesn’t seem like this is quite as easy as looking up a whois from ARIN.<br class=""><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">Sincerely,<br class=""><br class="">Eric Tykwinski<br class="">TrueNet, Inc.<br class="">P: 610-429-8300</div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Mar 7, 2020, at 7:46 PM, John R. Levine <<a href="mailto:johnl@iecc.com" class="">johnl@iecc.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class=""><blockquote type="cite" class="">Most DNS registers avoid verifying customer information as long as the payment clears (for a short time). DKIM (and DNSSEC) is built on top of trusting tokens from third-parties which disclaim all liability.<br class=""></blockquote><br class="">Right. The only promise that DKIM makes is that if you have a stream of mail signed by the same domain, you can praise or blame the same entity for it. It's a handle that recipient systems can use to build a reputation system, not a whitelist. DKIM has worked this way since 2006, the documentation is entirely clear that's what it does, and I'm kind of surprised you haven't gotten the memo.<br class=""><br class=""><blockquote type="cite" class="">Phone companies and advertisers have already demonstrated they can't be trusted to act as third-party introducers.<br class=""></blockquote><br class="">No kidding. I've talked to people at big telcos who are in the middle of STIR/SHAKEN and they tell me they plan to use it pretty much the same way that mail providers use DKIM. Some senders will have a good reputation and their calls will be delivered, some won't, and not so much. As with mail, it also provides a handle to push back on people sending unwanted junk.<br class=""><br class=""><blockquote type="cite" class="">Eventually we'll have STE/STU-equivalent end-to-end verification on our smartphones.<br class=""></blockquote><br class="">That's known not to work for e-mail spam, so I can't imagine why anyone would expect it to work for phone calls.<br class=""><br class="">Regards,<br class="">John Levine, <a href="mailto:johnl@taugh.com" class="">johnl@taugh.com</a>, Primary Perpetrator of "The Internet for Dummies",<br class="">Please consider the environment before reading this e-mail. <a href="https://jl.ly" class="">https://jl.ly</a><br class=""></div></div></blockquote></div><br class=""></div></div></body></html>