Subject: [spfbis] More SUBMITTER data

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 11 Apr 2012 02:43:20 +0000

As I mentioned previously, the vast majority of the MTAs advertising the SUBMITTER extension out there are actually instances of MxLogic providing cloud filtering services for some domain.

A contact at McAfee has told me that recent logs show about 11% of clients, all of whom are shown the SUBMITTER extension, actually make use of it.

-MSK

---

From: Paul Midgen <[email-masked]>
Date: Wed, 11 Apr 2012 03:21:58 +0000

11% of a distinct count of agents or of some agent-agnostic number of inbound connections? Can they say what % of non-spam internet email volume that represents?

From: [email-masked] [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Tuesday, April 10, 2012 7:43 PM
To: [email-masked]
Subject: [spfbis] More SUBMITTER data

-MSK

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 11 Apr 2012 04:28:15 +0000

My understanding is that it's 11% of distinct agents make use of the SUBMITTER extension, even though it's offered to everyone.  I don't have any data on whether or not they're spammers or whether or not those same clients are using domains that publish "spf2.0/pra" records (which would be necessary for use of SUBMITTER to be meaningful), but I can ask them.

I also suspect the spammer question, while interesting, will ultimately be considered an invalid criterion for determining whether or not the extension is "in use".

-MSK

From: [email-masked] [mailto:[email-masked]] On Behalf Of Paul Midgen
Sent: Tuesday, April 10, 2012 8:22 PM
To: Murray S. Kucherawy; [email-masked]
Subject: Re: [spfbis] More SUBMITTER data

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]] On Behalf Of Murray S. Kucherawy
Sent: Tuesday, April 10, 2012 7:43 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [spfbis] More SUBMITTER data

-MSK

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 11 Apr 2012 13:03:36 +0200

On Wed 11/Apr/2012 11:27:18 +0200 Murray S. Kucherawy wrote:
>
> My understanding is that it’s 11% of distinct agents make use of the
> SUBMITTER extension, even though it’s offered to everyone.

I think they mean that in 11% of distinct sessions their clients made
use of the SUBMITTER extension.  Is that correct?

I have further difficulties reading the long, last but one paragraph
of Section 3 of the I-D.  The last sentences in particular are not
very clear ("one of these {three|two}", which "That instance", what is
"vast majority".)

Would it be worth to promote that paragraph to its own subsection?

---

From: Hector Santos <[email-masked]>
Date: Wed, 11 Apr 2012 07:31:27 -0400

> Would it be worth to promote that paragraph to its own subsection?

I suspect that it was 11% different CHANNELS of MTA/MUAs.  It is very 
difficult without some deep pattern recognition to come close to a 
good SWAG (Scientific Wide Ass Guess) detection of different MTAs 
software. Then again, it could be a quick eyeball view to see that 
there are different clients based on that the patterns of their 
messages.  It could of use the X-Mailer header, but thats not always 
used and it could be stripped and replaced.

In my data, the definite majority are eMarketing vendors and even when 
their domains are different, you can see by their pattern of messages, 
they are the same vendors or use the same software and also templates. 
  But that has nothing to do nor suggest whether they are disqualified 
as valid protocol users.  In fact, it is expected that they behave 
properly and with compliancy otherwise regardless of type of sender, 
they are kicked out.

-- 
Hector Santos, CTO
http://www.santronics.com
http://hector.wildcatblog.com

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 11 Apr 2012 16:35:20 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of Alessandro Vesely
> Sent: Wednesday, April 11, 2012 4:04 AM
> To: [email-masked]

Yes.

> I have further difficulties reading the long, last but one paragraph of
> Section 3 of the I-D.  The last sentences in particular are not very
> clear ("one of these {three|two}", which "That instance", what is "vast
> majority".)
> 

You're right, I'll rework the text.  I was thinking of breaking up that section into subsections about each group of surveys or subtopic, though that means some subsections will only include a single paragraph, and I hate that.  :-)

-MSK

---

From: Scott Kitterman <[email-masked]>
Date: Wed, 11 Apr 2012 13:00:27 -0400

> You're right, I'll rework the text.  I was thinking of breaking up that
> section into subsections about each group of surveys or subtopic, though
> that means some subsections will only include a single paragraph, and I
> hate that.  :-)
 
It is still not clear to me why SUBMITTER is a standalone item for discussion.  
Since the SUBMITTER is supposed to the the PRA, the two are inextricably 
linked.  You can't do SUBMITTER without doing PRA calculations.

Scott K

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 11 Apr 2012 17:12:48 +0000

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Scott Kitterman
> Sent: Wednesday, April 11, 2012 10:00 AM
> To: [email-masked]
> Since the SUBMITTER is supposed to the the PRA, the two are
> inextricably linked.  You can't do SUBMITTER without doing PRA
> calculations.

They're not in terms of the conclusions, but they are in terms of presenting the data since the surveys were run separately.

-MSK