AOL's Plans for Domain Reputation

By J.D. Falk
Director of Product Management, Receiver Products

With every new technology, there are a few people who fully grok not only where it stands now, but where it's going -- who will be using it, and how. In our case, these are people whose thinking about reputation is so far ahead of the rest of the industry that if we would have had them as speakers at our IN conference a few weeks ago, and they revealed their visions of the future, everyone's heads would have exploded!

One of these is my friend Mike Adkins, who works on authentication and reputation for AOL. AOL has always been a leader in the industry, and Mike and I -- along with Dave Crocker, and other smart folks -- have been talking about the inevitable and much-needed intersection of authentication and reputation at MAAWG for the past few years. One of the recurring difficulties with this or any complex new technology is that it's new: there are no existing "best practices" and everyone is worried about making the first mistakes. Mike's fed up with this -- as are we all -- and he has decided to put a sharp wooden stake into the heart of the problem. Recently, he's been talking very candidly with the industry about AOL's future plans. The plans may change, he says, but this is their starting point -- and anyone who wants to continue sending mail to AOL's subscribers, or to understand the direction the rest of the industry is likely to take, needs to pay attention.

I tend to get overly wordy and perhaps somewhat theoretical when talking about this topic, so Return Path's marketing team has condensed what we understand of AOL's plan into a few simple bullet points:

• AOL will be implementing domain reputation next year. It will be used in parallel with their existing IP reputation system, and will include a domain-based feedback loop and domain-based whitelisting.
• Domain reputation will be based on DKIM. This way, it's actually your reputation -- not the reputation of some spammer who's been forging your domain. If you are not signing with DKIM, their old IP reputation system will still be in effect.
• All AOL sites -- including Compuserve and Netscape -- will use the same system.
• Announcements of the rollout and other relevant information will be posted on their postmaster site.

This is, still, a novel use of multiple, fairly young technologies -- and so we must applaud AOL's willingness to take the first public steps, and to be so open about their plans. Our colleagues elsewhere in the ISP world have indicated that they're developing similar plans, and for many, that will directly involve some new technology that we've been designing with them. Stay tuned for more....