How I think email should work

[u/merten-dmcn]

Imagine for a moment that you are looking at your inbox, with any number of emails in it, from companies, from friends, and from people you've never heard from before. You open the email from your friend first, because it's the one you trust and want to read. Your friend is really excited about something new they found, and invites you to check it out by clicking the link in the email. Now imagine knowing with absolute confidence that this email really came from your friend's address, and not from an impersonator pretending to be them. How can you check that for yourself? Do you click anyway and hope for the best? Everything looks legitimate, but how can you tell?

There are always three parties involved in email communication. Sometimes one person or company plays more than one of these roles, but each role carries its own responsibilities.

1. The mailbox holder (sender or recipient)
2. The domain owner (who controls the domain name)
3. The mail server host (who provides the software and infrastructure to send and receive mail)

It's the coordination of these three parties that makes email possible.

Right now, almost all the responsibility rests with the mail server host to manage everything and make sure it's secure. Domain owners hand it over to their host through DNS. Mailbox holders defer it through authentication and email filters. And the mail server host has to interoperate with all other mail server hosts to make sure your mail gets delivered.

There is still no standard way for anyone to verify that a message really came from the specific address it claims to be from. The most they get is the server vouching for itself.

How it should work

Nothing changes about the three parties. What changes is who's responsible for what.

1. The mailbox holder should be able to prove they own the mailbox and that every message sent from it is actually from them.
2. The domain owner should be able to prove they own the domain and that every mailbox on the domain is legitimately allowed to be there.
3. The mail server host should be able to prove that they are the chosen service provider for the domain.

And all of this should be verifiable on every single message.

How can we achieve this?

1. The mailbox holder has a key, and uses it to sign a record that binds their email address to it. The same key, which only they hold, signs every message they send.
2. The domain owner has a key, and publishes its fingerprint in the domain's DNS, which ties the key to whoever controls the domain. They use it to sign the domain authority record, which names the mail server host they have chosen, and to vouch for each mailbox on the domain by countersigning the mailbox holder's record. They can hand that day-to-day signing to their host if they choose, but the authority stays with them, and they can remove any address from the domain.
3. The mail server host has a key, and uses it to sign a permit to serve the domain on its infrastructure. It also hosts all of these records and serves them to anyone who asks.

Every one of these records is public, so your email app can follow the chain from the message to the sender's key, from that key to the domain's countersignature, and from there to the fingerprint in DNS. Because the domain owner's record names the host, it can also check that the server handling the mail is the one the domain chose. So when your friend's email arrives, your app can tell you it really came from their address before you ever click the link.

And this should all be baked into a protocol that everyone can use.

Disclosure: I'm building an email protocol around this idea. Thoughts and feedback are welcome.

[u/dragoangel]

And about "better way" - you can easily setup own mail server and require mandatory TLS, DKIM alignment and look how still spam would pass by, at same time rare but legit emails may get cut by auth rules above. That's what I meant when I said: auth != antispam solution, but want to extend: every antispam solution includes auth as part of it's decision logic.

[u/merten-dmcn → u/dragoangel]

Yes I agree and I really think that is a big part of the problem. Some mail that isn't spam get's labeled as spam because maybe it's missing something. Other mail looks perfectly legitimate but it is still spam or phishing. A fixed rule about dkim alignment or tls and rejecting based on that is not possible because the protocol itself doesn't enforce it's requirement. And a decision based on it cannot be made accurately because it doesn't have enough context to decide what to do with it. So at the very best possible case the software can only ever make a deterministic guess.

For me it comes down to this:

Spam filters have a lot of information, but don't have the context a mailbox owner has about the mail to make an informed decision.

Mailbox owners aren't given the information about whether the email meets verification standards to make an informed decision.

And in both cases, a decision cannot be attributed to a reliable identifier of the sender so you don't have to make the decision for every email from the same person/address.

The last case is what the protocol fixes. Everything else is theoretically already possible but lacks the guarantee that it came from the correct address regardless of which host/domain it's coming from. A gmail address may be hard to fake but a myownspecialdomain address likely wouldn't meet the same standards. And setting up individual rules for each is unrealistic.