All forms of signing email are generally solving the wrong problem

DKIM is not solving the wrong problem, DKIM is solving an underlying problem.

The suggestions to use reputation, accounts etc are still fine and good, but step 0 is to check whether that guy on the other side is who he says he is - and that's where DKIM comes in.

I don’t know about signing, but my email domain (my surname.net) is now 30 or so years old. It gets^w got a lot of spam...

A decade or so ago, I set up a catch-all account so <anything>@mydomain.net is redirected to an isp-account that I have as one of my email identities, In this case I used <account>@mac.com. It’s basically just a front-line imap repository, stuff I want to keep will move off it.

Whenever I need to supply an email to an online site, I use <company name>@mydomain.net. The only time this hasn’t worked is with Samsung, who won’t let you sign up as ‘samsung@...’, generally it’s ok though.

There is another rule on the mail server, send-to-trash. This accepts all email and just bins it. I can move <anything>@mydomain to this rule at the click of a button in a second or two on with a web-interface. I do this for:

- unsolicited email sent to a random “name” at my address, this is actually fairly rare now that most of the obvious ones are gone - when the mail content doesn’t match the <company name> part, ie: where the address has been sold to an email-list. - when I want to expire the email address. Sometimes this is temporary, and I have an address I want to keep, but it’s current;y being spammed. Making the server send reject messages For a while usually helps. Usually.

Using this, I’ve managed to keep the same email domain since college some 30 years ago actually useable and useful. YMMV :)

> It's possible that email clients could learn some lessons from this, for example by splitting your inbox into 'people and places you've interacted with before' and 'new contacts from strange people'.

That's how I have Thunderbird set up. I have a rule that puts mail from anyone not in my contacts list into a folder called Unrecognized Sender.

S/MIME is excellent.

I know its currently more suitable for an organization than individuals, but, I think with a bit of glue it would work fantastically at internet-scale.

There are two (well, lots more than two) different problems with email. DKMS solves spoofing. That isn't a more or less "wrong" problem than spam. The latter just needs a different solution (and Google etc. have become pretty good at it).

The author obviously has no idea why email signing are there. And what he was proposing, a authorizing system, or white-list system has been there for quite a while but why it is not enabled by default? It creates more problems then the problems it resolves. Just imagine how it going to work if you need to send a legit email to someone for the first time. If you are going to need authorization to do it, How do you get that required authorization? By calling the recipient or send them a letter so that they can add you to the list? Then what the point to send email in the first place?

Pretty unconvinced that (the lack of) revokable authorization is the problem with email. But for the sake of argument, lets say it was.

DKIM+whitelist solves that problem, so dkim would still be solving the right problem.

Another problem with email is that it's your responsibility to keep your contacts list up-to-date when people change their email address. By comparison Facebook doesn't have that problem - for example organising a high school reunion is much more likely to succeed if you contact people via Facebook than via email. I really hope email (or its successor) can copy more of the benefits that currently draw users into those walled gardens.

I've been using SpamArrest for about ten years, and I'm very happy with it.

I always whitelist in advance any person or domain I expect to hear from. SpamArrest gives me a chance to hear from legitimate strangers. If a sender refuses to reply to the challenge email, then what (s)he had to say couldn't be that important.

Here we go again.

I suggest that everyone in the comments with a pet idea read this: https://craphound.com/spamsolutions.txt

DKIM works well for what it does. Assuming that what the author describes as “revocable authorization” is a desirable feature (I don’t really get why a user wouldn’t just filter them with a block list or white list approach, but whatever) - how is this possible without a centralised provider?

If it’s only possible with a centralised entity like Twitter, it’s not going to scale to last centuries like email will.

All you have to do is to ignore email that is signed by entities you don't know and/or don't like. It is as simple as that. The mystery is why people accept anonymous email at all.

Easy solution: enable a configurable monetary barrier. People who want notes from strangers can set it low, people who don't can set the price higher.

Hey, Basecamp, can you make that feature for me?