The present generation "domain plus IP" email reputation query / response SIQ protocol has been in use in production mail servers since July 2003. This succinct slide presentation was made at the ASRG "Identity, Authentication and Reputation" session of the 61st IETF meeting held in Washington DC November 2004.

The SIQ protocol has MTA query clients available for sendmail, postfix and exchange, plus command line query clients for *nix and win.

DNSBL and DNSWL (Domain Name System BlackList and WhiteList) methods are well known and have been around in production use for many years. In practical use to my knowledge they rely on UDP. The SIQ protocol query clients and servers we use are UDP based as well. The main reason for choosing UDP is speed. The SIQ protocol presently allows for fallback to HTTP.

The SIQ protocol Internet Draft is available here: http://www.ietf.org/internet-drafts/draft-irtf-asrg-iar-howe-siq-01.txt
and will be resubmitted based on suggestions that came out of the Sendmail Meeting of the Minds and additional comments from a subsequent meeting with Eric Allman.

Note that the SIQ protocol is just a way to move queries and responses - it does not dictate how scores are computed. Any number of different and/or competing email Reputation Aggregators or Smart Caches could employ the SIQ protocol for handling queries and responses.


Eric Allman mentioned the possibility that exchanges between some of the units in this diagram might be done by pub/sub. For years, I have been saying that I think the Aggregator needs to be able to update or remove items from the Smart Caches. The concept of using RSS to send pre-aggregated data updates to Smart Caches excites me - possibly because I haven't investigated it thoroughly enough yet to find the performance limitations or downsides.

And possibly because RSS seems to be working so well on a large scale for other things already. I'm into practical application of technology and I love re-purposing commodity technologies.

I'm not an expert on the protocols being used for reputation sharing by DCC, GoSSIP, Cloudmark and others in the reputation field. Let's hear from those who are.