a question about keyservers

[Andrew Gallagher]

On 19/10/2026 11:27, Anton Shepelev via Gnupg-users wrote:
> 
> I should also observe that WKD/WKS is generally
> considered a better alternative to centralised key
> servers, as it is less vulnerable to key-spamming
> attacks:              <https://wiki.gnupg.org/WKD> .
WKD is generally better for the following use case:

1. example.com's domain admins support PGP
2. Bob does not already have a key for alice at example.com

Bob can then use example.com's WKD server to find a plausible key for 
Alice. This avoids a lot of spam issues, but at a price:

1. Relatively few domains run a WKD server
2. A lot of trust is placed in the email-domain admins
3. Alice (or an attacker who compromises her account) can prevent 
distribution of updates (such as third-party revocations)

If the email provider is part of your threat model, or is just being 
uncooperative, then WKD doesn't help much.

The key advantage of public keyservers is that they will distribute 
updates for anyone's key, and many keyservers (such as keys.openpgp.org) 
have strict antispam protections.

So I would normally recommend using both WKD and public keyservers, 
wherever possible.

A