Subject: [marf] draft-ietf-marf-as Section 5 Solicited and Unsolicited Reports

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Mon, 23 Jan 2012 13:50:07 -0500

I believe that 5.  Solicited and Unsolicited Reports should list the
abuse address from the whois record of the source IP as a reasonable 
candidate for receiving feedback.

If there is a PTR for that address, would an associated abuse address
be a reasonable candidate for receiving feedback? If so, would it only
be reasonable for FCrDNS?

-- 
     Shmuel (Seymour J.) Metz, SysProg and JOAT
     Atid/2        <http://patriot.net/~shmuel>
We don't care. We don't have to care, we're Congress.
(S877: The Shut up and Eat Your spam act of 2003)

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 23 Jan 2012 14:18:38 -0800

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Shmuel Metz
> Sent: Monday, January 23, 2012 10:50 AM
> To: Message Abuse Report Format working group
> Subject: [marf] draft-ietf-marf-as Section 5 Solicited and Unsolicited Reports
> 

I have some concerns about doing this, since the reply from a WHOIS query is non-standard.  Do we really want to say "apply some unspecified heuristic to the WHOIS reply to get that address"?

> be reasonable for FCrDNS?

I don't think so.  I don't think we want to start encouraging people to try to find any domain to which to prepend "abuse@" to start sending reports.  DKIM is the exception, because a valid DKIM signature makes a strong statement the likes of "Yes, we handled this message."  A PTR record, for example, does not.

-MSK

---

From: Steve Atkins <[email-masked]>
Date: Mon, 23 Jan 2012 14:45:06 -0800

> I have some concerns about doing this, since the reply from a WHOIS query is non-standard.  Do we really want to say "apply some unspecified heuristic to the WHOIS reply to get that address"?

It's all heuristics. However, ARIN and RIPE at least have some structure in their responses, including explicitly recorded abuse contacts. When they exist (which they usually do) that does give you an IP address to abuse address mapping - and while the contact is often too far up the delegation tree to be the right contact, it's seldom an actively bad contact:

OrgAbuseHandle: ABUSE1036-ARIN
OrgAbuseName:   Abuse Department
OrgAbusePhone:  +1-510-580-4100
OrgAbuseEmail:  [email-masked]
OrgAbuseRef:    http://whois.arin.net/rest/poc/ABUSE1036-ARIN

> I don't think so.  I don't think we want to start encouraging people to try to find any domain to which to prepend "abuse@" to start sending reports.  DKIM is the exception, because a valid DKIM si…

DKIM states that the owner of the d= hostname signed[1] the message. That could mean anything between them being the spammer, to them being the ISP of a end user with a compromised box. Whether that's an appropriate entity to contact requires applying some heuristics, and mapping that d= value to an appropriate email address requires some more.

In the case where an ESP is signing the mail sent by their customers with a d= value inside the customers domain then there may not be an abuse@X address for any given d=X or d=Y.X, and even when there is it's unlikely to be the right address to contact for abuse issues. Simple heuristics based on ARIN or RIPE registry data are likely to be much more accurate in that case.

Cheers,
  Steve

[1] Or delegated signing responsibility to, or...

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 23 Jan 2012 15:11:23 -0800

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Steve Atkins
> Sent: Monday, January 23, 2012 2:45 PM
> Subject: Re: [marf] draft-ietf-marf-as Section 5 Solicited and Unsolicited Reports
> 
> It's all heuristics. However, ARIN and RIPE at least have some
> structure in their responses, including explicitly recorded abuse
> contacts. When they exist (which they usually do) that does give you an
> IP address to abuse address mapping - and while the contact is often
> too far up the delegation tree to be the right contact, it's seldom an
> actively bad contact:
> 

As long as there's some place we can point people to read a document that defines the syntax they use, I'm less apprehensive about doing so.  Otherwise, saying "extract an abuse reporting address from this blob somehow" feels too heuristic to be in a standards document, IMO.

> >> be a reasonable candidate for receiving feedback? If so, would it
> >> only be reasonable for FCrDNS?
> >
> > I don't think so.  I don't think we want to start encouraging people
> > to try to find any domain to which to prepend "abuse@" to start sending
> > reports.  DKIM is the exception, because a valid DKIM signature makes a
> > strong statement the likes of "Yes, we handled this message."  A PTR
> > record, for example, does not.
> 
> DKIM states that the owner of the d= hostname signed[1] the message.
> That could mean anything between them being the spammer, to them being
> the ISP of a end user with a compromised box. Whether that's an
> appropriate entity to contact requires applying some heuristics, and
> mapping that d= value to an appropriate email address requires some
> more.

True, but DKIM makes a stronger statement than any other identifier extracted directly from the message.  That's why I hold it, and maybe a domain verified by SPF, as tolerable exceptions.

Basically, I can't think of a case where it's actually inappropriate to try, though it certainly could be the case that it's pointless to try.

-MSK

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Mon, 23 Jan 2012 21:55:28 -0500

In
<[email-masked]>,
on 01/23/2012
   at 02:18 PM, "Murray S. Kucherawy" <[email-masked]> said:

>I have some concerns about doing this, since the reply from a WHOIS
>query is non-standard.

There is a common de facto standard of labels conting the word abuse.
However, I was assuming that the usolicited ARF reports would be
mostly semi-manually generated.

>Do we really want to say "apply some unspecified heuristic to the
>WHOIS reply to get that address"?

Like parsing comments? BTDT,GTS.

>I don't think we want to start encouraging people to try to find any
>domain to which to prepend "abuse@" to start sending reports. 

I wasn't suggesting prepending abuse@ to the rDNS, I was asking about
doing a whois on it or parent domains.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 23 Jan 2012 21:19:08 -0800

> Sent: Monday, January 23, 2012 6:55 PM
> To: [email-masked]
> However, I was assuming that the usolicited ARF reports would be mostly
> semi-manually generated.

It needs to be written down and reference-able for us to use it, in my opinion.

> >Do we really want to say "apply some unspecified heuristic to the WHOIS
> >reply to get that address"?
> 

What standard advocates parsing comments to extract actionable data?

-MSK

---

From: Shmuel (Seymour J.) Metz <[email-masked]>
Date: Tue, 24 Jan 2012 08:19:50 -0500

In
<[email-masked]>,
on 01/23/2012

>What standard advocates parsing comments to extract actionable data?

No standard, I hope, just code. And, yes, it is a hack.

I was thinking of text like

   Other uses for ARF involve reports sent between parties that
   don't know each other, with the recipient address typically
   being abuse@domain (see [RFC2142]), looked up via WHOIS, or
   using other heuristics.  The reports may be manual, or automated
   due to hitting spam traps, scored high by spam filters, or
   anything else that the sender of the report considers to merit
   an abuse report.  The abuse addresses in the whois records of
   the source IP and its FCrDNS are likely reasonable candidates
   for receiving fedback about the message, although automated
   parsing may be difficult.

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 25 Jan 2012 11:17:46 -0800

> Sent: Tuesday, January 24, 2012 5:20 AM
> To: [email-masked]

Ah, that's much more palatable than what I was envisioning.  Thanks.

-MSK