Cédric Dufour
Secure E-Mail Policies



Spam being a genuine nuisance nowadays - which I see no reason to go along with, meaning I don't want to have to read or sort a single spam message in my inbox - I have implemented several policies concerning my e-mail address, which you may experience or choose to follow to help me (and you) fight spam.

Digital Signature and Encryption

Spam would simply become (practically) impossible if everyone adopted digital signature and encryption when sending e-mail messages.

In order to promote the adoption of such techniques, I invite you to send me digitally signed messages (using your own digital ID). I personally sign messages using my personal SuisseID, which is considered legally valid in the view of the Swiss law (SCSE, OSCSE).

If you are new to digital signature and if you are using Mozilla Thunderbird, please have a look at this Mozilla FAQ's article.

Tagged Addresses and Challenge-Response Whitelisting

Beside common techniques such as Realtime Black Lists (RBL), Sender Policy Framework (SPF), Content Analysis (SpamAssassin) and other usual tricks, I use two mechanisms that may surprise the first-time user:

  • Tagged Addresses: You may have received from me a strange-looking e-mail address - e.g. cdufour-keyword-foo.abc123 (AT) ced-network.net - which is a tagged address. Tagged addresses allow to restrict the usage of an e-mail address according to time, sender or a specific keyword, thus allowing a better control of how and by whom an e-mail address is used.
  • Challenge-Response Whitelisting: While messages sent using a tagged e-mail address will get delivered seamlessly, messages sent to my untagged (normal looking) e-mail address will be intercepted and checked against a whitelist. If your e-mail address is not yet in this whitelist, your message will be put "on-hold" and a challenge will be sent to you, inviting you to simply reply to it in order to have your e-mail address whitelisted (and your original message delivered).