<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><DIV><SPAN class="Apple-style-span"><B> 1. Policy Proposal Name:</B> Documentation of the Mail-From Authentication Method</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"> <B> 2. Authors:</B></SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 1. name: Paul Vixie</DIV><DIV> 2. email: <A href="mailto:paul@vix.com">paul@vix.com</A></DIV><DIV> 3. telephone: +1 650 423 1300</DIV><DIV> 4. organization: Internet Systems Consortium</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 1. name: Mark Kosters</DIV><DIV> 2. email: <A href="mailto:markk@verisignlabs.com">markk@verisignlabs.com</A></DIV><DIV> 3. telephone: +1 703 948 3200</DIV><DIV> 4. organization: Verisign</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 1. name: Chris Morrow</DIV><DIV> 2. email: <A href="mailto:christopher.morrow@verizonbusiness.com">christopher.morrow@verizonbusiness.com</A></DIV><DIV> 3. telephone: +1 703 886 3823</DIV><DIV> 4. organization: Verizon Business/UUnet</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 1. name: Jared Mauch</DIV><DIV> 2. email: <A href="mailto:jmauch@us.ntt.net">jmauch@us.ntt.net</A></DIV><DIV> 3. telephone: +1 214 915 1356</DIV><DIV> 4. organization: NTT/Verio</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 1. name: Bill Woodcock</DIV><DIV> 2. email: <A href="mailto:woody@pch.net">woody@pch.net</A></DIV><DIV> 3. telephone: +1 415 831 3100</DIV><DIV> 4. organization: Packet Clearing House</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 3. Proposal Version:</B> 1</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 4. Submission Date:</B> Tuesday, October 24, 2006</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 5. Proposal type:</B> New</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 6. Policy term:</B> Permanent</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><B> 7. Policy statement:</B></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> DELETION FROM THE NRPM</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 3.5.1 Mail-From</DIV><DIV> This section intentionally left blank.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> ADDITION TO THE NRPM</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> 3.5.1 Mail-From</DIV><DIV> Mail-From is the default authentication method by which</DIV><DIV> registration records are protected from vandalism. If a</DIV><DIV> registrant fails to designate a more secure method, any</DIV><DIV> subsequent email which bears the sender address of an</DIV><DIV> authorized Point of Contact may be deemed authentic with</DIV><DIV> regard to the registrant's records. Since it is trivial</DIV><DIV> to forge a sender address, Mail-From should not be</DIV><DIV> regarded as secure. Use of Mail-From authentication is</DIV><DIV> not recommended to any registrant who has the means to</DIV><DIV> implement either of the more secure cryptographic</DIV><DIV> authentication methods.</DIV><DIV><SPAN class="Apple-tab-span" style="white-space:pre"> </SPAN></DIV><DIV><B> 8. Rationale:</B></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> This policy complements the previously-proposed "Reinstatement of</DIV><DIV> PGP Authentication Method" which introduces section 3.5 to the</DIV><DIV> NRPM. Section 3.5 relates the existence of three authentication</DIV><DIV> methods. Two of those, mail-from and X.509, were preexisting but</DIV><DIV> not documented within the NRPM.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV> This policy proposal simply seeks to provide brief documentation</DIV><DIV> of the existence of the mail-from authentication method. Because</DIV><DIV> the specific wording of the documentation may be subject to</DIV><DIV> debate, and is in no way interdependent upon the documentation of</DIV><DIV> the other two methods, it is being proposed in a separate policy,</DIV><DIV> so that consensus may be more easily reached.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 9. Timetable for implementation:</B> Immediate</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><SPAN class="Apple-style-span"><B> 10. Meeting presenter:</B> Bill Woodcock</SPAN></DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV>END OF TEMPLATE</DIV><DIV><BR class="khtml-block-placeholder"></DIV></BODY></HTML>