Bret - here's a rundown from Frank Reiter, a fellow barn-mate. Frank pays a lot of attention to emerging tech 'n stuff and has quite a bit to say about spam solutions. (Background: We actually had a version of this conversation internally last Thursday afternoon with Elliot and a bunch of us in a brainstorming session. Elliot is doing something or another at the Aspen Institute this week related to spam and wanted to get a better sense of the continuum of anti-spam solutions that are out there. Frank presented a few proposals that have been floating around that closely resemble the Yahoo! implementation.)

"...here's a comment that you can pass on...

I haven't read the spec but the basic concept is likely pretty simple, something like this:

Associated with every domain name and retrievable via DNS is a public key to be used for validating email apparently from that domain. Any email apparently from a domain that has such a DNS record will be checked by decrypting some kind signature added to the message.

It is the nature of public key cryptography that something which can be decrypted by the public key can only be created if one has the matching private key, which cannot be practically derived from the public key. The signature should be something that is tied to the message contents, perhaps an md5 hash, so that it cannot be copied from message to message.

- If the domain has a public key available and there is no signature, reject as a forgery

- If the domain has a public key available and the signature is invalid, reject as a forgery

- If the domain has a public key available and the message has a valid signature, accept it

- If there is no key available, accept for now. Someday when adoption is near universal start rejecting such messages, making the use of such keys mandatory.

Now here's the question in my mind - will they require a commercially purchased certificate or will they allow people to generate their own private/public key pairs?"

I love his closing question.