Policy Proposal 2007-2: Documentation of the Mail-From Authentication Method

Status: Board Rejected

Tracking Information

Discussion Tracking

Mailing List:

Formal introduction on PPML on 16 February 2007

Staff assessment - 13 April 2007
Last call - 25 April through 9 May 2007 Public Policy Mailing List

ARIN Public Policy Meeting:


ARIN Advisory Council:

2 November 2006
16 November 2006
18 January 2007
15 February 2007
24 April 2007
17 May 2007

ARIN Board of Trustees:

Cryptographic Authentication




Paul Vixie,
Mark Kosters,
Chris Morrow,
Jared Mauch,
Bill Woodcock

Proposal type: New

Policy term: Permanent

Policy statement:


12.1 Mail-From
This section intentionally left blank.


12.1 Mail-From
Mail-From is the default authentication method by which registration records are protected from vandalism. If a registrant fails to designate a more secure method, any subsequent email which bears the sender address of an authorized Point of Contact may be deemed authentic with regard to the registrant's records. Since it is trivial to forge a sender address, Mail-From should not be regarded as secure. Use of Mail-From authentication is not recommended to any registrant who has the means to implement either of the more secure cryptographic authentication methods.


This policy complements the previously-proposed "Reinstatement of PGP Authentication Method" which introduces section 12 to the NRPM. Section 12 relates the existence of three authentication methods. Two of those, mail-from and X.509, were preexisting but not documented within the NRPM.

This policy proposal simply seeks to provide brief documentation of the existence of the mail-from authentication method. Because the specific wording of the documentation may be subject to debate, and is in no way interdependent upon the documentation of the other two methods, it is being proposed in a separate policy, so that consensus may be more easily reached.

Timetable for implementation: Immediate