From vesely@tana.it Sat May 12 01:41:03 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B426221F8600 for ; Sat, 12 May 2012 01:41:03 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.409 X-Spam-Level: X-Spam-Status: No, score=-3.409 tagged_above=-999 required=5 tests=[AWL=-1.090, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, J_CHICKENPOX_41=0.6, J_CHICKENPOX_44=0.6, J_CHICKENPOX_48=0.6, J_CHICKENPOX_64=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sTTTzkST12s4 for ; Sat, 12 May 2012 01:41:02 -0700 (PDT) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id B413821F85F6 for ; Sat, 12 May 2012 01:41:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336809596; bh=qxbRyuBQYUzSKmced4wwxJ0l3WQNvHaRUt1wLvc/Uqk=; l=1283; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=TPDae/SzUoakAuhTypOJjXbh+d41gZMiHiBCEq7Bf9X/toY3b8QiWaNzHYEkycLqh O+ibKZOrsUKL2T978RHGVKcL5SX1itBc9QpJCK+zS2TU2L0B0KLnChkNQsopMfnEL4 ueheu/joAXw1iLWx2exbIBnveFp+yHUgN3rgH9cI= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sat, 12 May 2012 09:59:56 +0200 id 00000000005DC033.000000004FAE187C.000054DB Message-ID: <4FAE187B.9030902@tana.it> Date: Sat, 12 May 2012 09:59:55 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: Anti-Spam Research Group - IRTF References: <4FA8FBCA.3050904@tana.it> In-Reply-To: <4FA8FBCA.3050904@tana.it> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 May 2012 08:41:03 -0000 This probably belongs to ASRG, not only because MARF has finished, but also because a *Taxonomy of reporting targets* should be hosted somewhere, and I'm unable to think of a better place than this list's wiki. Opinions? -------- Original Message -------- From: vesely@tana.it Date: Tue, 08 May 2012 12:56:10 +0200 To: marf@ietf.org Subject: SPF's helo identity as a reporting target Hi all, someone on the spf-discuss list noted that the smtp.helo is often of a different type than the domains usually branded in smtp.mailfrom, header.from, and dkim.d. That's because it seems to be quite common to outsource mail relaying as well as MX services. This situation characterizes relaying services as third parties that might manage complaints and/or enforce policies, much like ESPs and ISPs. MARF-AS generically allows any "domain that has been verified by the [relevant] authentication mechanism", as well as "Abuse addresses in WHOIS records of the IP address". Would it be feasible to correlate auth methods' properties to roles, in general? For example, ESPs normally wouldn't outsource mail relaying, since it's their core business. Thus, sending a complaint to abuse@_smtp.helo_ could be a way to target any involved ESP. Just mumbling... From clewis+ietf@mustelids.ca Sat May 12 10:47:01 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EFF1B21F85B8 for ; Sat, 12 May 2012 10:47:01 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.552 X-Spam-Level: * X-Spam-Status: No, score=1.552 tagged_above=-999 required=5 tests=[BAYES_50=0.001, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id lO5-3rEOQL43 for ; Sat, 12 May 2012 10:47:01 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 033F221F858F for ; Sat, 12 May 2012 10:47:00 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4CHktbE006831 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sat, 12 May 2012 13:46:56 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4CHktbE006831 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336844816; bh=6rVwc8g4XyphF0Vna34EGYfGbR05r0H6URAIJJsfHSk=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=1fbYF9KKRo0wH6izCwST5Tc+E0ybWOkrSQ2mB5Dj6SqP0hj8NPIWG8zBJfSYKsNQ5 vOE/c7ffzGTlKeBI6HVyPgVGkLmYp5tO/VMT7tPBJfY2chxXMNqg2neevzfptHcH+s hTT1uYunp66Ewk8bSYyIlbkaNXiRcJMzd3l7mHH8= Message-ID: <4FAEA20F.8090302@mustelids.ca> Date: Sat, 12 May 2012 13:46:55 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> In-Reply-To: <4FAE187B.9030902@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 12 May 2012 17:47:02 -0000 On 12-05-12 03:59 AM, Alessandro Vesely wrote: > This probably belongs to ASRG, not only because MARF has finished, but > also because a *Taxonomy of reporting targets* should be hosted > somewhere, and I'm unable to think of a better place than this list's > wiki. > > Opinions? It would be nice if it could be made usable. This would tend to make a large organization having all of their servers helo exactly the same way, which flies in the face of industry BCP (eg: MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly violates its intent. Or they use wildcarded MXes. Ick. Makes "divisional" abuse addresses very difficult. Or use the registration level domain (lop off the non-registration level FQDN qualifiers) - makes "divisional" abuse addresses impossible, and the registration level domain chop is real hard to do with some tlds. The absolute death of this proposal is, tho, that it puts the abuse reporting address under the control of the spammer and becomes a DDOS weapon. I could just see it - it gets implemented for tana.it, and the next day's blast of 10 billion cutwail botnet spams uses "HELO tana.it". Kaboom!!! From vesely@tana.it Sun May 13 02:58:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DA0D421F85F2 for ; Sun, 13 May 2012 02:58:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.593 X-Spam-Level: X-Spam-Status: No, score=-4.593 tagged_above=-999 required=5 tests=[AWL=0.126, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KVyeqRJSyJWR for ; Sun, 13 May 2012 02:58:45 -0700 (PDT) Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 74EBE21F85F4 for ; Sun, 13 May 2012 02:58:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336903121; bh=kA2WXgEh+AKdEXjOUdW9wrz74E0ZWXozSHjYx7cLYxM=; l=1678; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=Y1bEHAWWfC3178TnXbxQxe9O75qN2BKvOY66ivvuWyu9i5NW6SQzQuV5xfFGyIkg1 yNPL6MzI8le0XfL0yB4alPnqcP6qdgxU8ZEN998ZAQZ/H+MpWPx7eUXv9OXm0VeF65 ZnTlWLZFNkfVzktqd9+UhZ9+m0ONz1hxbtbdpRCc= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sun, 13 May 2012 11:58:41 +0200 id 00000000005DC039.000000004FAF85D1.00002B5A Message-ID: <4FAF85D0.8050305@tana.it> Date: Sun, 13 May 2012 11:58:40 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> In-Reply-To: <4FAEA20F.8090302@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 09:58:47 -0000 On Sun 13/May/2012 11:07:45 +0200 Chris Lewis wrote: > On 12-05-12 03:59 AM, Alessandro Vesely wrote: >> This probably belongs to ASRG, not only because MARF has finished, but >> also because a *Taxonomy of reporting targets* should be hosted >> somewhere, and I'm unable to think of a better place than this list's >> wiki. >> >> Opinions? > > It would be nice if it could be made usable. > > This would tend to make a large organization having all of their servers > helo exactly the same way, which flies in the face of industry BCP (eg: > MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly > violates its intent. I see nothing wrong if an organization uses the same helo name for all its mailouts. A helo name does not have to be a label of any DNS record. However, in case it has an SPF record it could be validated. > The absolute death of this proposal is, tho, that it puts the abuse > reporting address under the control of the spammer and becomes a DDOS > weapon. > > I could just see it - it gets implemented for tana.it, and the next > day's blast of 10 billion cutwail botnet spams uses "HELO tana.it". > > Kaboom!!! No, wait. Didn't I say it has to get an SPF "pass" to get usable? I must have considered it implied... my bad. An idea is that if you offer virtual MTA services, you may want to get complaints. Unless you hijack each customer's abuse@, using helo names might be more practical than relying on RIR's whois, depending on your network providers. But did anyone try that? And if anyone did, where do they publish their experiences? Where do postmasters learn to target complaints effectively? From clewis+ietf@mustelids.ca Sun May 13 08:29:30 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 23E4E21F852A for ; Sun, 13 May 2012 08:29:30 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.252 X-Spam-Level: X-Spam-Status: No, score=0.252 tagged_above=-999 required=5 tests=[AWL=1.300, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id KS3hdJiighIG for ; Sun, 13 May 2012 08:29:29 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 5B02821F8526 for ; Sun, 13 May 2012 08:29:29 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4DFTJYe008300 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 13 May 2012 11:29:21 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4DFTJYe008300 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336922961; bh=kDDTXF5xnijdr87MhCLrVLdlmxqklXXaX8tl8Vsv1+M=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=dnMIu78KFB2UF2yWW+t4V/yWd7wygw+CZB09r8hkhiGaj9nY1KFHROae5sdkWpm9Z 4ysXTMLCFB28Sm8zFPLX4xA0P0owWe4vAz+XzPLRm0HYb+aMxrdSbRI3N3P/0Jg0Sv XU369tGJG+0qB2gT/cwOx+lL6ykwfuIYeKLfWTpQ= Message-ID: <4FAFD34F.6010301@mustelids.ca> Date: Sun, 13 May 2012 11:29:19 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> In-Reply-To: <4FAF85D0.8050305@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 15:29:30 -0000 On 12-05-13 05:58 AM, Alessandro Vesely wrote: > On Sun 13/May/2012 11:07:45 +0200 Chris Lewis wrote: >> On 12-05-12 03:59 AM, Alessandro Vesely wrote: >>> This probably belongs to ASRG, not only because MARF has finished, but >>> also because a *Taxonomy of reporting targets* should be hosted >>> somewhere, and I'm unable to think of a better place than this list's >>> wiki. >>> >>> Opinions? >> >> It would be nice if it could be made usable. >> >> This would tend to make a large organization having all of their servers >> helo exactly the same way, which flies in the face of industry BCP (eg: >> MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly >> violates its intent. > > I see nothing wrong if an organization uses the same helo name for all > its mailouts. A helo name does not have to be a label of any DNS > record. Uh what? RFC5321: Section 4.1.1.1: These commands are used to identify the SMTP client to the SMTP server. The argument clause contains the fully-qualified domain name of the SMTP client, if one is available. In situations in which the SMTP client system does not have a meaningful domain name (e.g., when its address is dynamically allocated and no reverse mapping record is available), the client SHOULD send an address literal (see Section 4.1.3). ... The SMTP server identifies itself to the SMTP client in the connection greeting reply and in the response to this command. Yeah, I suppose you could make all your outbounds have the same name (up to whatever limit DNS imposes), but clearly this violates the intent. And it's also very explicitly counter to industry practises/BCP. From vesely@tana.it Sun May 13 10:21:47 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B51AB21F854B for ; Sun, 13 May 2012 10:21:47 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.597 X-Spam-Level: X-Spam-Status: No, score=-4.597 tagged_above=-999 required=5 tests=[AWL=0.122, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id H0I0C1JN6S7P for ; Sun, 13 May 2012 10:21:47 -0700 (PDT) Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id A13AE21F8546 for ; Sun, 13 May 2012 10:21:46 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336929704; bh=tKh6ojeda06CU/YkEgZ1MF6RmfYatepOLEOfrCPUyqs=; l=1735; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=OAeCwxyvmzPMlu80ahzNqktGsXF5yOicy7yo9WqknERd289PR/PoomjxtZ6XCPCyd sfJwY72go5nlr0wOnOIqrNSaKjV52cmD4n1ziOZ0LdaekOMcURgGSTe6XDzR9mAjJR GIw50PFeX4qCxiT7gcgonQzhhvf+Do1VX14S5k48= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sun, 13 May 2012 19:21:44 +0200 id 00000000005DC035.000000004FAFEDA8.00000C1A Message-ID: <4FAFEDA8.4090009@tana.it> Date: Sun, 13 May 2012 19:21:44 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> In-Reply-To: <4FAFD34F.6010301@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 17:21:47 -0000 On Sun 13/May/2012 18:59:23 +0200 Chris Lewis wrote: > On 12-05-13 05:58 AM, Alessandro Vesely wrote: >> On Sun 13/May/2012 11:07:45 +0200 Chris Lewis wrote: >>> >>> It would be nice if it could be made usable. >>> >>> This would tend to make a large organization having all of their servers >>> helo exactly the same way, which flies in the face of industry BCP (eg: >>> MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly >>> violates its intent. >> >> I see nothing wrong if an organization uses the same helo name for all >> its mailouts. A helo name does not have to be a label of any DNS >> record. > > Uh what? > > RFC5321: > > Section 4.1.1.1: > > These commands are used to identify the SMTP client to the SMTP > server. The argument clause contains the fully-qualified domain name > of the SMTP client, if one is available. This has been discussed so many times that we don't need to do it once more. For one (John Klensin on Jan 2009): The 1123-imposed requirement (carried forward into Section 4.1.4 Paragraph 6 of 5321) that messages not be rejected on the basis of a validation failure with the EHLO argument would presumably remain even if we deprecated 821 and client use of HELO. http://www.imc.org/ietf-smtp/mail-archive/msg05420.html > Yeah, I suppose you could make all your outbounds have the same name (up > to whatever limit DNS imposes), but clearly this violates the intent. > > And it's also very explicitly counter to industry practises/BCP. I'd agree that violating intents and/or practices is not a good start. That seems to imply that it is necessary to use scripts to keep helo names, IP addresses, and SPF in sync. Would that be worth? From clewis+ietf@mustelids.ca Sun May 13 11:03:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E911421F8564 for ; Sun, 13 May 2012 11:03:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.048 X-Spam-Level: X-Spam-Status: No, score=-1.048 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TEkgytNhhWIw for ; Sun, 13 May 2012 11:03:32 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 9179B21F855D for ; Sun, 13 May 2012 11:03:32 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4DI3Vph007604 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 13 May 2012 14:03:31 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4DI3Vph007604 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336932211; bh=pY5mMk8LXxnpNwDKXgMMui8t4Z8d0/c76WoO8gEqyoc=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=tuT8QqtQGQZPmWR/+uopFOSLqFqEhm7VflumNrBSs9KfSjkrL2jaBbubSpotuMVBK O5QJ6rXbINpyVtPN975vb0nZlY0LLnmp0FfRouplzG3OoSSRvh3Aj0z4SYqYGrlcLA shiKXFFfTPhxCZChW8dlECFzVGvw/ObhjjdiSUFU= Message-ID: <4FAFF773.10207@mustelids.ca> Date: Sun, 13 May 2012 14:03:31 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> <4FAFEDA8.4090009@tana.it> In-Reply-To: <4FAFEDA8.4090009@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 18:03:33 -0000 On 12-05-13 01:21 PM, Alessandro Vesely wrote: > On Sun 13/May/2012 18:59:23 +0200 Chris Lewis wrote: >> On 12-05-13 05:58 AM, Alessandro Vesely wrote: >>> On Sun 13/May/2012 11:07:45 +0200 Chris Lewis wrote: >>>> >>>> It would be nice if it could be made usable. >>>> >>>> This would tend to make a large organization having all of their servers >>>> helo exactly the same way, which flies in the face of industry BCP (eg: >>>> MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly >>>> violates its intent. >>> >>> I see nothing wrong if an organization uses the same helo name for all >>> its mailouts. A helo name does not have to be a label of any DNS >>> record. >> >> Uh what? >> >> RFC5321: >> >> Section 4.1.1.1: >> >> These commands are used to identify the SMTP client to the SMTP >> server. The argument clause contains the fully-qualified domain name >> of the SMTP client, if one is available. > > This has been discussed so many times that we don't need to do it once > more. For one (John Klensin on Jan 2009): > > The 1123-imposed requirement (carried forward into Section 4.1.4 > Paragraph 6 of 5321) that messages not be rejected on the basis > of a validation failure with the EHLO argument would presumably > remain even if we deprecated 821 and client use of HELO. > http://www.imc.org/ietf-smtp/mail-archive/msg05420.html On the one hand, we have Klensin commenting on rejecting email based upon helo validation (despite which, helo factors very heavily into filtering anyway), versus _explicitly_ violating the RFC in a proposed standard. Klensin's argument doesn't apply to this proposal. At all. >> Yeah, I suppose you could make all your outbounds have the same name (up >> to whatever limit DNS imposes), but clearly this violates the intent. >> And it's also very explicitly counter to industry practises/BCP. > I'd agree that violating intents and/or practices is not a good start. > That seems to imply that it is necessary to use scripts to keep helo > names, IP addresses, and SPF in sync. Would that be worth? The reality is going to be is that since it relies on SPF to be valid, few people would bother implementing it on the sending side, and there will be more than enough people ignoring the requirement to SPF verify before trusting it, that kabooms! will still happen. There are other ways of doing this that doesn't require ancilliary gunk like SPF. There's at least one IP-based DNSBL that yields the same data. From clewis+ietf@mustelids.ca Sun May 13 11:30:17 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 1AF5E21F851B for ; Sun, 13 May 2012 11:30:17 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.118 X-Spam-Level: X-Spam-Status: No, score=-0.118 tagged_above=-999 required=5 tests=[AWL=-0.929, BAYES_20=-0.74, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id gluDRxXPT4R9 for ; Sun, 13 May 2012 11:30:17 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id AB49321F84FF for ; Sun, 13 May 2012 11:30:16 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4DIUEjF013218 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 13 May 2012 14:30:14 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4DIUEjF013218 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336933815; bh=rHgGACDXcmNkzupLDEplBcFfl8SqaUjGIXGkfyGth4Y=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=S7hW6C2d3YMDbNyJVwy+IAWR9SP1sa4N/x7cb56p7VN/M7REbsUC3Ax3Ha3HKQ0X2 wQhfG6aLSJAj/HSfNmT+/8ivT5BAvO5NmfQC965eeZfrqnCyDECJSGcOJfUg0zyr8l SiztIJf2swxgKGszQG8p6jP4E1nAYFAxmkJ/AFj8= Message-ID: <4FAFFDB6.4020405@mustelids.ca> Date: Sun, 13 May 2012 14:30:14 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> In-Reply-To: <4FAF85D0.8050305@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 18:30:17 -0000 On 12-05-13 05:58 AM, Alessandro Vesely wrote: > No, wait. Didn't I say it has to get an SPF "pass" to get usable? > I must have considered it implied... my bad. It doesn't help. spammerdomain.com IN MX 0 wmail.tana.it. spammerdomain.com IN TXT "v=spf1 ip4:0/0 -all" [May not be exact, but you get the idea.] 10 billion cutwail spams heloing as spammerdomain.com later... From vesely@tana.it Sun May 13 11:40:40 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9BA0121F854F for ; Sun, 13 May 2012 11:40:40 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.599 X-Spam-Level: X-Spam-Status: No, score=-4.599 tagged_above=-999 required=5 tests=[AWL=0.120, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Y3a6Z4m2BQCd for ; Sun, 13 May 2012 11:40:40 -0700 (PDT) Received: from wmail.tana.it (mail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id C031421F8546 for ; Sun, 13 May 2012 11:40:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336934433; bh=OVhkn1rarDMQ7V+mHE1DlT3XVuJ5QbuhFI3G8851bA0=; l=1304; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=Ys4xCJayZI6b0A9qrrFEs3L1Tw7bXJH/7mhxEkm82ZMA2G3h27k73faUNVCmOFFY6 XjcC+WDuAiUq6yV4Ac7PDJUMl2IXHwnMz6LV1mp/elwiUucg1JD/FaTvS5Y/9LCwRi ePHJ8MJ7uPhAAi8xwaAv+UOqequVGsPyEYAtEnBc= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sun, 13 May 2012 20:40:33 +0200 id 00000000005DC039.000000004FB00021.00001D45 Message-ID: <4FB00020.6080105@tana.it> Date: Sun, 13 May 2012 20:40:32 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> <4FAFEDA8.4090009@tana.it> <4FAFF773.10207@mustelids.ca> In-Reply-To: <4FAFF773.10207@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 18:40:40 -0000 On Sun 13/May/2012 20:13:44 +0200 Chris Lewis wrote: > On 12-05-13 01:21 PM, Alessandro Vesely wrote: >> That seems to imply that it is necessary to use scripts to keep helo >> names, IP addresses, and SPF in sync. Would that be worth? > > The reality is going to be is that since it relies on SPF to be valid, > few people would bother implementing it on the sending side, and there > will be more than enough people ignoring the requirement to SPF verify > before trusting it, that kabooms! will still happen. So it would be an error-prone technique? We are talking about /postmasters/ extracting target addresses for abuse reporting, not end users. Shouldn't that imply some knowledge? SPF records are going to sport a new ra= modifier, specifying an address for reporting authentication failures, not abuse. That may bring further confusion, in fact. > There are other ways of doing this that doesn't require ancillary gunk > like SPF. There's at least one IP-based DNSBL that yields the same data. Which one do you mean? DNS lists like abusix get their data from RIRs' whois databases. In that case, virtual MTA providers would have to restrict their choice of network providers based on proper management of whois records, besides cost, bandwidth, uptime, support, ... From vesely@tana.it Sun May 13 11:49:10 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D434421F8565 for ; Sun, 13 May 2012 11:49:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.601 X-Spam-Level: X-Spam-Status: No, score=-4.601 tagged_above=-999 required=5 tests=[AWL=0.118, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id AnzQs9qWibic for ; Sun, 13 May 2012 11:49:10 -0700 (PDT) Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 1C0E621F854F for ; Sun, 13 May 2012 11:49:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336934949; bh=M9FMZX0Myyr93iATo2KWpr5xarWvQ9U+fTksDtJXqsg=; l=630; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=f8WOqUCskGaj3dozdjIY13e2yYvbO/PUuEV7U3MhedZ1YUvALtn/ojTMM/TzY/edE bVpI75zitiB65kA7F+ucPzBH2d3ci36sFxDMaPzyXAXemAW7x6teCJQRDFSkQsdh21 bzrOlOWfOoqdotyqob6pfloucCG0xLulWNuwncB0= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Sun, 13 May 2012 20:49:09 +0200 id 00000000005DC039.000000004FB00225.00001F29 Message-ID: <4FB00224.7010500@tana.it> Date: Sun, 13 May 2012 20:49:08 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> In-Reply-To: <4FAFFDB6.4020405@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 18:49:10 -0000 On Sun 13/May/2012 20:44:58 +0200 Chris Lewis wrote: > On 12-05-13 05:58 AM, Alessandro Vesely wrote: > >> No, wait. Didn't I say it has to get an SPF "pass" to get usable? >> I must have considered it implied... my bad. > > It doesn't help. > > spammerdomain.com IN MX 0 wmail.tana.it. > spammerdomain.com IN TXT "v=spf1 ip4:0/0 -all" That's not quite how helo authentication works. When they say "helo wmail.tana.it" the server looks up wmail.tana.it. wmail.tana.it. IN TXT "v=spf1 redirect=tana.it" tana.it. IN TXT "v=spf1 +ip4:62.94.243.226 -all" They won't get a "pass" unless they are using that ip4. From clewis+ietf@mustelids.ca Sun May 13 12:55:10 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id ECA8D21F8504 for ; Sun, 13 May 2012 12:55:10 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.398 X-Spam-Level: X-Spam-Status: No, score=-0.398 tagged_above=-999 required=5 tests=[AWL=0.650, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xZm4RoPAz7Wu for ; Sun, 13 May 2012 12:55:10 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 27B6B21F8503 for ; Sun, 13 May 2012 12:55:10 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4DJt83f030413 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 13 May 2012 15:55:08 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4DJt83f030413 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336938908; bh=o3iA72E85DYXEJ/q2yLZ6S3TCQg81x/eBYDqtwvS+nc=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=JK5JqQZ+BqdexlXo4BCzqbwerfhXsFOU5BimeJeCG6Ty03C4rWS25hUMFepszNPu5 K1WxWcwDr3O//zm3KWvs0OVga2aIzpd2FDl+y3o729tzeBJztI3NWZ62NW1wGLK72P uSR9dbXbjuv/kT5XguNji86hdSzlcVb6IYny76GU= Message-ID: <4FB0119C.9000901@mustelids.ca> Date: Sun, 13 May 2012 15:55:08 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> <4FAFEDA8.4090009@tana.it> <4FAFF773.10207@mustelids.ca> <4FB00020.6080105@tana.it> In-Reply-To: <4FB00020.6080105@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 19:55:11 -0000 On 12-05-13 02:40 PM, Alessandro Vesely wrote: > On Sun 13/May/2012 20:13:44 +0200 Chris Lewis wrote: >> On 12-05-13 01:21 PM, Alessandro Vesely wrote: >>> That seems to imply that it is necessary to use scripts to keep helo >>> names, IP addresses, and SPF in sync. Would that be worth? >> >> The reality is going to be is that since it relies on SPF to be valid, >> few people would bother implementing it on the sending side, and there >> will be more than enough people ignoring the requirement to SPF verify >> before trusting it, that kabooms! will still happen. > > So it would be an error-prone technique? We are talking about > /postmasters/ extracting target addresses for abuse reporting, not end > users. Shouldn't that imply some knowledge? It should. But it doesn't. > SPF records are going to sport a new ra= modifier, specifying an > address for reporting authentication failures, not abuse. That may > bring further confusion, in fact. Right. As one said "the best thing about standards is that there's so many to choose from" ;-) >> There are other ways of doing this that doesn't require ancillary gunk >> like SPF. There's at least one IP-based DNSBL that yields the same data. > > Which one do you mean? DNS lists like abusix get their data from > RIRs' whois databases. That's an implementation detail. There's no reason that they'd _have_ to. Mine doesn't rely on whois for responsible domain or abuse contact. While it does the published RIR maps for allocations and countries, it does no whois queries. abuse.net's doesn't use whois for anything. I don't think Cymru's or Mynetwatchman's does. It's _very_ hard to get domains from whois in an even remotely "global sense", let alone abuse addresses. > In that case, virtual MTA providers would have > to restrict their choice of network providers based on proper > management of whois records, besides cost, bandwidth, uptime, support, ... "Proper management" of IP whois records is probably coming as unlikely as it seems, so another reason for it wouldn't hurt. From clewis+ietf@mustelids.ca Sun May 13 12:56:51 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8163521F8549 for ; Sun, 13 May 2012 12:56:51 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 0.13 X-Spam-Level: X-Spam-Status: No, score=0.13 tagged_above=-999 required=5 tests=[AWL=-0.311, BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id VLMVtqL+aVoV for ; Sun, 13 May 2012 12:56:51 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id B000821F8564 for ; Sun, 13 May 2012 12:56:50 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4DJunMF031170 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Sun, 13 May 2012 15:56:49 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4DJunMF031170 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1336939010; bh=kvAr7PzyUdvJNcY/B+jL+CQxe9mObvn+b0Isrf9SXDc=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=KPAzBN8PfwHEWTcihAOpk9J0S4iXnmipa6H1RzJ1oXuQaWUsiHjvkwCVIiRxKFRAa 1Ap6RAO4iENLuqvrXo+C087DU3177XTp8DS+3xSPoi+rzMNhc3Y/6vprM+R/qIrJ0q FMNKrsbhXP1ZXjUx30t3pjm7B8hgpE5QJjwtYcko= Message-ID: <4FB01201.9030209@mustelids.ca> Date: Sun, 13 May 2012 15:56:49 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> <4FB00224.7010500@tana.it> In-Reply-To: <4FB00224.7010500@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 13 May 2012 19:56:51 -0000 On 12-05-13 02:49 PM, Alessandro Vesely wrote: > On Sun 13/May/2012 20:44:58 +0200 Chris Lewis wrote: > >> On 12-05-13 05:58 AM, Alessandro Vesely wrote: >> >>> No, wait. Didn't I say it has to get an SPF "pass" to get usable? >>> I must have considered it implied... my bad. >> >> It doesn't help. >> >> spammerdomain.com IN MX 0 wmail.tana.it. >> spammerdomain.com IN TXT "v=spf1 ip4:0/0 -all" Whoops, I meant: _smtp.spammerdomain.com IN MX 0 wmail.tana.it > > That's not quite how helo authentication works. When they say "helo > wmail.tana.it" the server looks up wmail.tana.it. No. The spammer says "helo spammerdomain.com". Postmaster sends complaint to abuse@_smtp.spammerdomain.com. Where does that go? From vesely@tana.it Mon May 14 02:26:08 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E023321F8603 for ; Mon, 14 May 2012 02:26:08 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.302 X-Spam-Level: X-Spam-Status: No, score=-4.302 tagged_above=-999 required=5 tests=[AWL=-0.183, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, J_CHICKENPOX_57=0.6, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sc9yWCh+M0sx for ; Mon, 14 May 2012 02:26:08 -0700 (PDT) Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 1A55721F85F7 for ; Mon, 14 May 2012 02:26:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336987566; bh=KXCVl4WFfK6Ntovx6wGViQeMMHTF1O9o4Ni2krcCY/E=; l=693; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=bA0hJiPV8z7rIHFxDJ0XOA+ZhmpUQM4Cc3oaPdcHOt05bB2u+18DzMGA9wBjN79fV eVAxFvGfmSgl2djtUYF+5d7DJacm7jprWzwGC8h68jz6qNnF5Fl3/B50qKYL7Lj6jx tnhxm8wZfhbnrlS9HPsA7RM1kor+kWOjNHUZB5hk= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Mon, 14 May 2012 11:26:06 +0200 id 00000000005DC039.000000004FB0CFAE.000064E6 Message-ID: <4FB0CFAD.5040703@tana.it> Date: Mon, 14 May 2012 11:26:05 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> <4FB00224.7010500@tana.it> <4FB01201.9030209@mustelids.ca> In-Reply-To: <4FB01201.9030209@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 09:26:09 -0000 On Mon 14/May/2012 10:34:06 +0200 Chris Lewis wrote: > > Whoops, I meant: > > _smtp.spammerdomain.com IN MX 0 wmail.tana.it > > The spammer says "helo spammerdomain.com". More or less. > Postmaster sends complaint to abuse@_smtp.spammerdomain.com. > > Where does that go? That's plain abuse, though. There must be loads of national laws that the owner of that zone openly breaks. Isn't that too much risky from a legal POV, considering its effectiveness is probably less than other kinds of DDoS? 220 wmail.tana.it ESMTP HELO goofy.example 250 wmail.tana.it Ok. MAIL FROM:<> 250 Ok. RCPT TO: 513 Relaying denied. QUIT 221 Bye. From vesely@tana.it Mon May 14 02:27:56 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 7421B21F85D9 for ; Mon, 14 May 2012 02:27:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.6 X-Spam-Level: X-Spam-Status: No, score=-4.6 tagged_above=-999 required=5 tests=[AWL=0.119, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2DjNOFm0IQ00 for ; Mon, 14 May 2012 02:27:55 -0700 (PDT) Received: from wmail.tana.it (mail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 838EA21F85D8 for ; Mon, 14 May 2012 02:27:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1336987674; bh=aNh2ZoX9ECHETjICvryp1LWPG/YAECV2ZSrY7JoFXZQ=; l=1990; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=CGORabtldc2fK5oL3KWUM0yumIIepQBV3Habh293nF3usHg41im9TraNWuta7ovAI qds67i/oKOHgdAqM0LG6j1Qeey6T7PN6Wz+9k7F8eFz+dAP5lh+WmXw/fRK4sqFhs1 Hp5d7ssbhAdKdM3gyC5ltr0x1wDweKDkdlzxQc3s= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Mon, 14 May 2012 11:27:54 +0200 id 00000000005DC039.000000004FB0D01A.0000655C Message-ID: <4FB0D01A.4000300@tana.it> Date: Mon, 14 May 2012 11:27:54 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> <4FAFEDA8.4090009@tana.it> <4FAFF773.10207@mustelids.ca> <4FB00020.6080105@tana.it> <4FB0119C.9000901@mustelids.ca> In-Reply-To: <4FB0119C.9000901@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: [Asrg] Reporting targets, was SPF's helo identity as a X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 09:27:56 -0000 On Mon 14/May/2012 10:48:08 +0200 Chris Lewis wrote: > On 12-05-13 02:40 PM, Alessandro Vesely wrote: >> On Sun 13/May/2012 20:13:44 +0200 Chris Lewis wrote: > >>> There are other ways of doing this that doesn't require ancillary gunk >>> like SPF. There's at least one IP-based DNSBL that yields the same data. >> >> Which one do you mean? DNS lists like abusix get their data from >> RIRs' whois databases. > > That's an implementation detail. There's no reason that they'd _have_ > to. Mine doesn't rely on whois for responsible domain or abuse contact. > While it does the published RIR maps for allocations and countries, it > does no whois queries. And how does it discover abuse contacts? > abuse.net's doesn't use whois for anything. Yes, but it's not IP-based. It falls back to RFC 2142 role addresses, and relies on cooperative contributions (I think). > I don't think Cymru's or Mynetwatchman's does. Thanks for the pointers, I'll take a look at them. > It's _very_ hard to get domains from whois in an even remotely "global > sense", let alone abuse addresses. > >> In that case, virtual MTA providers would have >> to restrict their choice of network providers based on proper >> management of whois records, besides cost, bandwidth, uptime, support, ... > > "Proper management" of IP whois records is probably coming as unlikely > as it seems, so another reason for it wouldn't hurt. That would be a Good Thing. However, it may appear a double-edged sword, as it hides the network provider's abuse team. One could navigate whois records hierarchically, so if the virtual MTA operator is a bad guy, the abuse contact at the upper level should be its network provider. This operation can be done recursively, but homogeneity may obscure awareness. That is, by climbing the tree all the way up, one eventually gets at IANA's --which hopefully will never be a bad guy-- but might not realize what role corresponds to each level. From clewis+ietf@mustelids.ca Mon May 14 07:04:32 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 85E6D21F8483 for ; Mon, 14 May 2012 07:04:32 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.237 X-Spam-Level: X-Spam-Status: No, score=-0.237 tagged_above=-999 required=5 tests=[AWL=0.211, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, J_CHICKENPOX_57=0.6, RDNS_NONE=0.1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GAaNm7+MV4CT for ; Mon, 14 May 2012 07:04:31 -0700 (PDT) Received: from mail.mustelids.ca (unknown [174.35.130.2]) by ietfa.amsl.com (Postfix) with ESMTP id 923B721F8472 for ; Mon, 14 May 2012 07:04:31 -0700 (PDT) Received: from [192.168.0.8] (otter.mustelids.ca [192.168.0.8]) (authenticated bits=0) by mail.mustelids.ca (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id q4EE4Nvu002856 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for ; Mon, 14 May 2012 10:04:26 -0400 X-DKIM: Sendmail DKIM Filter v2.8.3 mail.mustelids.ca q4EE4Nvu002856 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mustelids.ca; s=default.private; t=1337004266; bh=95bbpfeHbvdtHgx9E3kEHHilv/+2Ga89Jnxz450K7Mc=; h=Message-ID:Date:From:MIME-Version:To:Subject:References: In-Reply-To:Content-Type:Content-Transfer-Encoding; b=E6gUrZSELAN2FPTdvfjPL8t1B+95HsJa6RAnafrZef7uHZDGictc0Ye+m4QkctZnA W2szbwg3+7o8wwoMp7w+Fs1WKObRJqZfvRuqxY4Wx4U/rWF49HgZjsP1fjDCoBdKiT J1dOu+/KZCpkpX13CKT3XdshzixcACixczMkidsE= Message-ID: <4FB110E7.1040803@mustelids.ca> Date: Mon, 14 May 2012 10:04:23 -0400 From: Chris Lewis User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv:1.8.1.23) Gecko/20090812 Thunderbird/2.0.0.23 Mnenhy/0.7.6.666 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> <4FB00224.7010500@tana.it> <4FB01201.9030209@mustelids.ca> <4FB0CFAD.5040703@tana.it> In-Reply-To: <4FB0CFAD.5040703@tana.it> X-Enigmail-Version: 1.5pre Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 14:04:32 -0000 On 12-05-14 05:26 AM, Alessandro Vesely wrote: > On Mon 14/May/2012 10:34:06 +0200 Chris Lewis wrote: >> Postmaster sends complaint to abuse@_smtp.spammerdomain.com. >> >> Where does that go? > > That's plain abuse, though. There must be loads of national laws that > the owner of that zone openly breaks. Isn't that too much risky from > a legal POV, considering its effectiveness is probably less than other > kinds of DDoS? Who said anything about a deliberate DDOS? Think of it as spam with electronic countermeasures designed to confuse, confound and distract the recipients and third parties. Just like they already do. "national laws ... openly breaks". You can say that with a straight face considering that 80-90% of all spam already does? > 220 wmail.tana.it ESMTP > HELO goofy.example > 250 wmail.tana.it Ok. > MAIL FROM:<> > 250 Ok. > RCPT TO: > 513 Relaying denied. > QUIT > 221 Bye. Big enough, the recipient site still loses before the 220. Eg: think back to when AOL bounced instead of rejected for no-such-user. From rsk@gsp.org Mon May 14 07:22:49 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 5C35421F8463 for ; Mon, 14 May 2012 07:22:49 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -6.599 X-Spam-Level: X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id P2QWgBAhwzrY for ; Mon, 14 May 2012 07:22:48 -0700 (PDT) Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by ietfa.amsl.com (Postfix) with ESMTP id C53E621F845F for ; Mon, 14 May 2012 07:22:48 -0700 (PDT) Received: from squonk.gsp.org (bltmd-207.114.25.246.dsl.charm.net [207.114.25.246]) by taos.firemountain.net (8.14.5/8.14.5) with ESMTP id q4EEMkYQ012104 for ; Mon, 14 May 2012 10:22:47 -0400 (EDT) Received: from vorlon.gsp.org (vorlon.gsp.org [192.168.0.20]) by squonk.gsp.org (8.14.3/8.14.3) with ESMTP id q4EEPhvu032701 for ; Mon, 14 May 2012 10:25:43 -0400 (EDT) Received: from localhost6.localdomain6 (localhost.localdomain [127.0.0.1]) by vorlon.gsp.org (8.14.3/8.14.3/Debian-9.2ubuntu1) with ESMTP id q4EEMehr020068 for ; Mon, 14 May 2012 10:22:40 -0400 Received: (from rsk@localhost) by localhost6.localdomain6 (8.14.3/8.14.3/Submit) id q4EEMdRU020064 for asrg@irtf.org; Mon, 14 May 2012 10:22:39 -0400 Date: Mon, 14 May 2012 10:22:39 -0400 From: Rich Kulawiec To: Anti-Spam Research Group - IRTF Message-ID: <20120514142239.GA19490@gsp.org> References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFD34F.6010301@mustelids.ca> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4FAFD34F.6010301@mustelids.ca> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 14:22:49 -0000 On Sun, May 13, 2012 at 11:29:19AM -0400, Chris Lewis quoted: > Section 4.1.1.1: +1, and let me add: One of the many reasons to make the HELO consistent with the FQDN is that it can be helpful in debugging. ---rsk From vesely@tana.it Mon May 14 07:34:46 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 30BAD21F87E5 for ; Mon, 14 May 2012 07:34:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -4.603 X-Spam-Level: X-Spam-Status: No, score=-4.603 tagged_above=-999 required=5 tests=[AWL=0.116, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fPseYzvNlEUt for ; Mon, 14 May 2012 07:34:45 -0700 (PDT) Received: from wmail.tana.it (mail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 184F221F87EA for ; Mon, 14 May 2012 07:34:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=test; t=1337006084; bh=5TI5Jbv6F4wVJnnRI444BL9QLapj/cpjogq8SJXk87I=; l=1166; h=Message-ID:Date:From:MIME-Version:To:References:In-Reply-To: Content-Transfer-Encoding; b=W1TmThA7DXLlzPB/yPnHT3nVG7dHpolI4WEDRsrOY44LfilofEe3OT4XEPvpaIYWy yWWQfoNilJhdEzrfVXZGDm5rFAdZx457ShcWHyAlBT65DpJKNKPe/REr0qvH25vuAS gsvlWqLVEvpGGkWryeLH38BAYmVfQ2120/ycucoE= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Mon, 14 May 2012 16:34:44 +0200 id 00000000005DC035.000000004FB11804.00003388 Message-ID: <4FB11803.2080401@tana.it> Date: Mon, 14 May 2012 16:34:43 +0200 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> <4FB00224.7010500@tana.it> <4FB01201.9030209@mustelids.ca> <4FB0CFAD.5040703@tana.it> <4FB110E7.1040803@mustelids.ca> In-Reply-To: <4FB110E7.1040803@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 14:34:46 -0000 On Mon 14/May/2012 16:19:57 +0200 Chris Lewis wrote: > On 12-05-14 05:26 AM, Alessandro Vesely wrote: > >> There must be loads of national laws that the owner of that zone >> openly breaks. Isn't that too much risky from a legal POV, >> considering its effectiveness is probably less than other kinds >> of DDoS? > > Who said anything about a deliberate DDOS? Think of it as spam with > electronic countermeasures designed to confuse, confound and distract > the recipients and third parties. Whatever the intent, I should get your permission before asserting that your server serves me. Shouldn't I? Then, yes, I suppose some judges still have difficulties understanding Internet protocols. > Just like they already do. > > "national laws ... openly breaks". You can say that with a straight > face considering that 80-90% of all spam already does? I don't have specific experience, but it seems to me that when spammers leave enough evidence behind them they can be taken to court. >> 220 wmail.tana.it ESMTP > > Big enough, the recipient site still loses before the 220. You're right. Rejecting is cheap, but still bears a cost. From dotis@mail-abuse.org Mon May 14 10:41:13 2012 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 56E4B21F8920 for ; Mon, 14 May 2012 10:41:13 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.505 X-Spam-Level: X-Spam-Status: No, score=-102.505 tagged_above=-999 required=5 tests=[AWL=0.094, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Jq8goiLBdl7t for ; Mon, 14 May 2012 10:41:12 -0700 (PDT) Received: from mailserv.mail-abuse.org (mailserv.mail-abuse.org [150.70.98.118]) by ietfa.amsl.com (Postfix) with ESMTP id B0AF721F878A for ; Mon, 14 May 2012 10:41:12 -0700 (PDT) Received: from US-DOUGO-MAC.local (unknown [10.31.37.8]) by mailserv.mail-abuse.org (Postfix) with ESMTPSA id 7F64A174014D for ; Mon, 14 May 2012 17:41:12 +0000 (UTC) Message-ID: <4FB143B8.4080306@mail-abuse.org> Date: Mon, 14 May 2012 10:41:12 -0700 From: Douglas Otis User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:12.0) Gecko/20120428 Thunderbird/12.0.1 MIME-Version: 1.0 To: asrg@irtf.org References: <4FA8FBCA.3050904@tana.it> <4FAE187B.9030902@tana.it> <4FAEA20F.8090302@mustelids.ca> <4FAF85D0.8050305@tana.it> <4FAFFDB6.4020405@mustelids.ca> <4FB00224.7010500@tana.it> <4FB01201.9030209@mustelids.ca> <4FB0CFAD.5040703@tana.it> <4FB110E7.1040803@mustelids.ca> <4FB11803.2080401@tana.it> In-Reply-To: <4FB11803.2080401@tana.it> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Asrg] SPF's helo identity as a reporting target X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 14 May 2012 17:41:13 -0000 On 5/14/12 7:34 AM, Alessandro Vesely wrote: > On Mon 14/May/2012 16:19:57 +0200 Chris Lewis wrote: > > On 12-05-14 05:26 AM, Alessandro Vesely wrote: > > > >> There must be loads of national laws that the owner of that zone > >> openly breaks. Isn't that too much risky from a legal POV, > >> considering its effectiveness is probably less than other kinds > >> of DDoS? > > > > Who said anything about a deliberate DDOS? Think of it as spam > > with electronic countermeasures designed to confuse, confound and > > distract the recipients and third parties. > > Whatever the intent, I should get your permission before asserting > that your server serves me. Shouldn't I? Then, yes, I suppose some > judges still have difficulties understanding Internet protocols. > > > Just like they already do. > > > > "national laws ... openly breaks". You can say that with a > > straight face considering that 80-90% of all spam already does? > > I don't have specific experience, but it seems to me that when > spammers leave enough evidence behind them they can be taken to > court. > > >> 220 wmail.tana.it ESMTP > > > > Big enough, the recipient site still loses before the 220. > > You're right. Rejecting is cheap, but still bears a cost. Dear Alessandro and Chris, Since RFC821, HELO/EHLO was defined as FQDN SMTP hostnames. There is no reason additional policy assertions such as those proposed for DMARC could not include authenticated email EHLO/HELO acceptance with a hostname from their domain, whether by a forward reference to an address list, or an SPF resource record. The domain validated would be determined by the domain of the SPF record and not by an SPF mechanism as Chris suggested. The goal of DMARC is to offer a safe method to reject messages in a way not likely to create support calls for receivers. A policy that can be extended to individual SMTP servers controlled by domains making compliance assertions should offer safe rejections having lower cost than message filtering or rejections based on the SMTP mail parameter. The mistake made by DMARC was not considering HELO/ELHO alignment against the parent domain rather than the hostname. Regards, Douglas Otis.