Subject: [Asrg] Declaration to the world

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 11:53:15 +0100

Peoples of the world, listen:

  I, the legal owner and emperor of the domain "danisch.de", hereby
  declare to the world, that all mail from this domain will be
  delivered from the IP address 213.133.101.23 only. I kindly ask
  you to not accept any mail with a sender address of this domain
  delivered from any other IP address, since it is considered to be
  forged. Thank you for your cooperation.

In what way would such a statement infringe anyone else's 
constitutional or other rights?

Hadmut
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 09:08:35 -0500

> constitutional or other rights?

it doesn't.  it's just not a generally-applicable mechanism. 

subject to relataively few constraints, you own 'danisch.de' for as long as
you renew it.  most users do not own their IP addresses.  in order for routing
to scale (at least with current routing protocols), it is necessary that
networks be renumbered from time to time.  so we do not want to encourage
tight binding of IP addresses to domain names even for those cases where it might
work, for now.  also, source addresses can sometimes be forged, so we don't
want to rely on them as authentiation tokens.

Keith

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 06 Mar 2003 14:22:06 +0000

> constitutional or other rights?

Because you don't 'own' this IP ?
You 'lease' it from Hetzner Online AG
who are assigned it by RIPE?

--
Regards,
Jon Kyme

--------------------------------------------------------------------
Get your free email address at http://www.merseymail.com/
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 15:28:39 +0100

> who are assigned it by RIPE?

I don't understand what you want to say...

Why should this be a problem or infringe anyone's rights?

Hadmut

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 06 Mar 2003 14:40:05 +0000

> Why should this be a problem or infringe anyone's rights?

Sorry, Keith Moore answered this better much than I did.

But, for instance how does the next 'owner' of danisch.de
invalidate your declaration? 
How do *you* invalidate it when your ISP (or RIPE) change your IP
out from under you?

--
Regards,
Jon Kyme

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 15:54:29 +0100

> How do *you* invalidate it when your ISP (or RIPE) change your IP

In the very same simple way I have changed the MX record for 
danisch.de and the A record for www.danisch.de when a new
IP address was assigned about half a year ago: I took a very
simple text editor, changed the zone file, and that's it.

The statement of the world is not an eternal and irrevocable 
statement. As any other policy, certificate, DNS entry or 
whatever, it needs to be updated from time to time. 

Sorry, but I'm a little bit shocked that this is so difficult 
to understand. I thought this was abvious. 

Don't get me wrong, but I am under the impression that some
people intentionally misunderstand everything in order to 
put through their political opinion.

And I am under the impression that this research group was
intentionally poisoned by spamming advocates.

Hadmut

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 10:03:20 -0500

> to understand. I thought this was abvious. 

there are things I thought were obvious too - such as that it's cumbersome to
maintain such records, that such records are likely to get out of sync with
reality, and that they're not generally applicable.  

of course when you accuse people who raise technical objections of doing so
because they are pushing political views, or that they are spamming advocates,
it doesn't exactly promote understanding of either the technical or political
issues.

but all of this is probably irrelevant for now.  what we should be doing now
is listing mechansisms and fitting them in to a taxonomy.  we don't need to
evaluate each mechanism as it comes up.  so we should add your suggestion to
the list and leave off evaluation until later.

Keith

---

From: "Jon Kyme" <[email-masked]>
Date: Thu, 06 Mar 2003 15:09:14 +0000

> simple text editor, changed the zone file, and that's it.

So your declaration is implicit in and limited to the DNS data
for the domain?

Doesn't this require this to be true for every domain if it is 
to work for yours? (This would be difficult for some systems I'd imagine.)

Or, if you have a separate mechanism for making this kind of declaration,
how is it to be publicised, invalidated etc.

> to understand. I thought this was abvious. 
It *seems* obvious.

> put through their political opinion.

I hope I understand you, I'm genuinely interested in what kind of
mechanism this might require.

> intentionally poisoned by spamming advocates.

I hope that's not true. Of course the RG may itself be a time-wasting ruse
set up by spammers to waste anti-spammers time. :-)

I'm an administrator on a webmail system with around 100k accounts.
I hate spam. I hate my users complaining.  I need a way to stop
it hurting 

--
Regards,
Jon Kyme

---

From: Liudvikas Bukys <[email-masked]>
Date: Thu, 06 Mar 2003 10:34:08 -0500

I looked back over the archives at the whole RMX discussion,
and looked at the Designated Senders draft as well, and it
appears that nobody has mentioned the problem that it
EITHER:
	- breaks legitimate forwarding such as mailing lists
OR
	- can be trivially worked around by forging Received headers

(After all, I didn't receive Hadmut Danisch's note from his server,
I received it from my internal relay, which received it from
an ietf.org server.)

So at most it is a possibly-useful Received header heuristic.

A more useful heuristic, for now, would be IP-based DNS records
indicating whether my host is authorized to initiate any SMTP at
all, as a way of cutting down on open relay/proxy/forgery.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 09:35:10 -0600

> reality, and that they're not generally applicable.  

Why are reverse MX records or domain specific DNSBLs any harder to
maintain that regular MX records?

-wayne

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 16:48:32 +0100

> So your declaration is implicit in and limited to the DNS data

Not necessarily DNS, that's just one possible implementation. 

It could also be put in an LDAP tree (if LDAP servers were widely 
available), put on a web page at a default address,...

There's a wide range of possibilities to distribute such a statement. 
Since SMTP requires DNS anyway, this advises to put such a statement
on a DNS server. That's actual my RMX proposal, just paraphrased.

> to work for yours? (This would be difficult for some systems I'd

I'm not sure whether I understand what you want to say again, but I'll
try it. No, it doesn't really "require". Therefore, it allows smooth
transition and is backwards compatible.

Of course, if other people receive millions of spam from
"@danisch.de", as it happened about a year ago, then it is their 
benefit to ask whether my domain publishes such a statement, and if 
so have a very simple and effective way to block all forged spam.

> how is it to be publicised, invalidated etc.

There are plenty of known methods to do so, e.g. the methods used
to distribute X.509 certificates etc. That's not a main problem. 

> mechanism this might require.

e.g. see 
http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-00.txt

regards
Hadmut

---

From: "Derek J. Balling" <[email-masked]>
Date: Thu, 6 Mar 2003 11:05:19 -0500

> I received it from my internal relay, which received it from

So in the DS model, you would configure your internal relay to do the 
DS test, which had a sender of <[email-masked]>, and ask IETF "is 
132.151.1.19 authorized to send mail for ietf.org?", get an assurance 
of trust, and move on.

You could then set up your final-MX to say "trust all mail from my 
internal relay, because it's already done those checks itself".

The received headers never come into play. It's strictly concerned 
sender-domain (from the envelope) and connecting IP.

D

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 6 Mar 2003 16:33:18 +0000

> maintain that regular MX records?

Because they mean people who like the way they do things right now have 
to change that, or RMX won't work for those people. Unfortunately those 
people aren't mom and pop, they are techies.

Matt.

---

From: "David F. Skoll" <[email-masked]>
Date: Thu, 6 Mar 2003 10:55:01 -0500 (EST)

> I received it from my internal relay, which received it from

The envelope sender was [email-masked].  So if you trust the
mailing list to validate Hadmut's note, and the mailing list has its
own RMX records, it still works.

--
David.

---

From: Pierre BRUA <[email-masked]>
Date: Thu, 06 Mar 2003 17:58:55 +0100

Hi,

For your information, this is already used at the monkeys.com domain, 
and they say it works pretty well to jugulate spam.
See
http://www.monkeys.com/anti-spam/filtering/additions.html

Pierre

-- 
           PARALLINE          ///        Parallelism & GNU/Linux
                             ///
71,av des Vosges Phone:+33 388 141 740
F-67000 STRASBOURG Fax:+33 388 141 741 http://www.paralline.com
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 12:06:07 -0500

> maintain that regular MX records?

it depends on how often the data changes.  most MX records are fairly
static.  DNSBLs are centrally managed, which is different.

Keith

---

From: Hadmut Danisch <[email-masked]>
Date: Thu, 6 Mar 2003 18:12:21 +0100

> people aren't mom and pop, they are techies.

As a consequence, we never could change anything, because you
alway find a couple of people who like the way it is. What are
we here for?

regards
Hadmut

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 11:42:14 -0600

> static.  DNSBLs are centrally managed, which is different.

Domain specific DNSBLs are maintained in the same zone file as the MX
records for a domain.  When you add an incoming mail server, you have
to add the MX record.  When you add an outgoing mail server, you have
to add either an RMX record or a CNAME.

Considering the volume on this list, I can hardly blame anyone for
missing this message, especially because it was only the third message
posted, but the domain specific DNSBL was mentioned here:

https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg00002.html

This mostly just contains a reference to:

http://groups.google.com/groups?q=vixie+mx+records+spam&hl=en&lr=&ie=UTF-8&oe=UTF-8&selm=3E18B0B3.43939A35%40Andrzej.Adam.Filip&rnum=10

-wayne

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 12:57:16 -0500

> http://www.monkeys.com/anti-spam/filtering/additions.html

Read a little further.  It only works reliabily enough to be worthwhile 
for a very limited number of very large domains.  Even if this was RFC'd 
into some sort of DNS convention or extension, it's trivially bypassed 
by the spammer choosing envelope senders that don't participate in the 
convention.  Given that, for example, huge chunks of the internet don't 
have [r]DNS at all, it's pretty clear it'd never become widespread 
enough to be long-term useful.

In other words, anything that relies on a significant fraction of the 
non-spammers to do something is doomed to failure.

Yes, the technique can be useful sometimes in specific situations.  But 
not well enough to enshrine into long-term standards, and useless the 
day after publication.

There's a similar heuristic, which is probably more effective in 
blocking spam - that is, for selected domains, _insist_ that the 
argument to HELO matches the peer's rDNS domain name in some fashion.

But again, while it's currently useful for some specific sites (eg: AOL, 
Hotmail/MSN, Yahoo), it's too easily bypassable and compliance will 
never be wide spread enough to enshrine into public standards.

It's rather a lot like discussing filtering based upon the phrase 
"Diplomas from prestigious non-*ccredited Universities".  _Still_ works 
well (which is why I munged it slightly).  But not for long after 
publishing it.  Oops ;-)

---

From: Matt Sergeant <[email-masked]>
Date: Thu, 6 Mar 2003 18:29:18 +0000

> alway find a couple of people who like the way it is. What are

I don't agree with the status quo. Someone asked for a reason and I 
gave it.

Matt.

---

From: Liudvikas Bukys <[email-masked]>
Date: Thu, 06 Mar 2003 13:51:10 -0500

>From: "Derek J. Balling" <[email-masked]>
>Message-Id: <[email-masked]>
>Date: Thu, 6 Mar 2003 11:05:19 -0500
>

BUT there is no envelope sender re-writing for (in sendmail parlance):
	- aliases without list owners
	- .forward forwarding

Should there be?  It would be a different world.
While that doesn't rule out adoption of RMX, it does make even
its adoption have pretty big impact on everyday normal practices.

P.S. I have now twice succumbed to the temptation to add
to the high-volume small-topic flood.  Now it's out of my
system, and I see the wisdom in Paul Judge's trying to move
the discussion toward longer and systematic drafts rather
than point-by-point reaction.  So I'll be quiet for a while.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 19:17:18 +0000

Guess you weren't listening.  This was _all_ said before.

A) RMX is broken, due to reliance on DNS

B) (presuming you fix that in some way) if everyone did this then an
existing functionality -- the ability to send mail from different
accounts using existing defacto functionality, software and
infrastructure -- is lost.

While there may be ways to _change_ massive amounts of infrastructure
to still be able to send from different accounts, it _has_ to be
acknowledged that this is a cost of this solution, to the millions of
people currently using that existing functionality.

As there appear to be other technologies which don't have this massive
problem, and in addition due to problem A) (that RMX is broken), it
doesn't appear to be an attractive candidate solution.

Adam

---

From: [email-masked]
Date: Thu, 6 Mar 2003 09:46:16 -0800 (PST)

DNS is specially designed to be tied to IP addresses and so are ip addresses 
to DNS (reverse dns which is in fact used by some mailers to establish 
identity). It seems to me we can not rely on just ip address or just domain
but both can be used with possibly additional means of authentication when 
one or the other changes. Big problem is how to provide distributed 
authentication if it must be independent of either ip addresses or domain names.

---

From: Keith Moore <[email-masked]>
Date: Thu, 6 Mar 2003 15:20:43 -0500

On Thu, 6 Mar 2003 09:46:16 -0800 (PST)
[email-masked] wrote:

> DNS is specially designed to be tied to IP addresses

uh, no. 

yes reverse DNS can be used to lookup domain names but DNS names are not
"tied" to IP address - the mapping from a DNS name to an IP address is
arbitrary, and so is the reverse mapping, the two don't have to match
or even exists. and anybody with an IP address block can claim that
those addresses are associated with any domain he likes.

IP-to-domain lookup is often meaningless anyway, in many cases returning
what is essentially a text representation of the IP address with some
provider's name appended.

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 14:42:48 -0600

> Guess you weren't listening.  This was _all_ said before.

I don't know about Hadmut, but I was listening.  I even reread the web
page about the DNS security problem.  While I'm not convinced that RMX
records or domain specific DNSBLs will dramatically cut down on the
spam problem, I am certainly not convinced that the idea is bogus.

> A) RMX is broken, due to reliance on DNS

Even with the birthday paradox attack, the spammer will have to send
out hundreds of forged DNS packets in order to have a good chance of
getting a bogus entry the target's DNS cache.  This is both very
detectable and it also greatly increases the amount of work that a
spammer has to do.

This is a much more serious problem when a bogus DNS lookup can expose
someone's bank account or other things that could get a huge payoff
from just a single forged DNS entry.  The payoff for the spammer is
almost nothing.  Somehow I don't think that spammers are going to be
the ones that will motivate this DNS security problem to be closed.

> infrastructure -- is lost.

Everyone would do this only if everyone didn't want to have their
domain names used indiscriminantly.  Only domain name owners who want
to limit who can send email claiming to be from them would create RMX
records or create a domain specific DNSBL.  Only MTAs that want to
respect domain name owner's wishes would enforce it.

Are you saying that domain name owners should not say who can use
their name and others should not be able to respect that request?

-wayne

---

From: [email-masked]
Date: Thu, 6 Mar 2003 10:35:14 -0800 (PST)

You're taking my words too literally. I did not say its one-one relationship,
in fact, its many-many and for dns->ip we can have multiple ips associated 
with the same dns and multiple dns pointing to the same ip, similarly
ip->dns can have multiple reverse name (rare, but allowed) and multiple 
ips giving the same name.

But what I meant is that either infrastrcture can be used to provide some 
means of authentication (not saying its done now or what is done can be 
trusted) but neither one can be relied by itself.

---

From: "Chris Lewis" <[email-masked]>
Date: Thu, 06 Mar 2003 16:05:52 -0500

> detectable and it also greatly increases the amount of work that a

I've not been following this in great detail, but I'd like to comment on 
this point.  It's worse than that.  It has to trick every recipient.

It's rather like true IP spoofing.  In some circumstances, it is indeed 
possible to spoof IPs.  But since it requires flooding the MTA for each 
  connection with thousands of packets, it becomes totally impractical 
if you're trying to spam more than a handful of recipients (even if 
you're on the same network interface as AOL's MTAs).

So, I don't think attacks on the DNS protocol are compelling. 
Subverting a DNS server is an entirely different thing.

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 19:43:20 +0000

We are here to find ways to reduce spam _preferably_ without breaking
big swathes of functionality, privacy and reliability.

There is plenty of room within these criteria.  That your schemes fair
badly does not mean we should take your "let's break everything to fix
spam" approach, it means that your schemes are bad candidates.  

Learn, adapt your solutions.

Adam

---

From: wayne <[email-masked]>
Date: 06 Mar 2003 16:05:38 -0600

In <[email-masked]> Adam Back <[email-masked]> writes:

> B) if everyone did this then an

Oh, one other thing about RMX or domain specific blacklists.  While it
is really out of the charter of this group, such a system would also
help reduce email worms that forge email addresses.

-wayne

---

From: Adam Back <[email-masked]>
Date: Thu, 6 Mar 2003 22:50:23 +0000

> this point.  It's worse than that.  It has to trick every recipient.

That depends on how RMX would be deployed.  I read the proposal to
suggest it would be deployed at mail hubs to defend against receiving
mail from IPs other than those the domain owner has delegated as being
allowed to.  In this case all the attacker has to spoof is the mail hub.

I think you're presuming it is implemented in the mail-client, and say
checked on download or on first read or something.  In this latter
case it would be pretty hard to reliably use DNS spoofing to spam.
But I don't think that was the intent.

Adam

---

From: "Chris Lewis" <[email-masked]>
Date: Fri, 07 Mar 2003 00:22:00 -0500

> allowed to.  In this case all the attacker has to spoof is the mail hub.

Sorry, I meant to say "trick every MTA", because it has to flood 
(something) for each MTA it tries to attack.  Which'd mean that it'd 
only be economic to spam _very_ large MTA farms, and maybe not even then.

So, yeah, you can spam a teensy bit, but the amount of overhead is too 
high to do it in sufficiently high volumes to be useful.

---

From: Adam Back <[email-masked]>
Date: Fri, 7 Mar 2003 07:18:39 +0000

> only be economic to spam _very_ large MTA farms, and maybe not even then.

Right, it would change the optimal spamming approach.  The trick to
efficient spamming would then be to target users of large ISPs, and/or
to target individual users for multiple spams on behalf of multiple
spammer clients.

For larger sites (hotmail, verizon, aol, etc) with millions of users
it wouldn't present much of a barier.  But it should reduce the spam
load for users of smaller ISPs and sites with smaller numbers of
users.

Of course this is all presuming adaptive behavior of spammers, perhaps
they would in practice avoid the cost in other ways (eg either violate
ISPs AUPs, or run their own RMX server).

Adam

---

From: Pierre BRUA <[email-masked]>
Date: Fri, 07 Mar 2003 12:44:16 +0100

Chris Lewis a écrit:
> for a very limited number of very large domains.

That's what it has been used for by monkeys.com, since they (of course) 
cannot take the time to implement rdns data for everyone.

>  Even if this was RFC'd 
> convention.

And such envelope sender domain owners, knowing it has been abused by 
spammers, would likely implement rdns records sooner or later, or being 
listed in blacklists of domains abused by spammers _and_ do not apply 
the rdns rfc.

If a domain is abused by spammers, it means for the domain owner 
millions of dns queries to verify that the domain really exist, bounce 
messages from everywhere, complaints, and so on. It doesn't get 
unnoticed and has quite a high network/server load cost anyway.

I know people whose domain has been abused like that and I can assure 
you they have spent a lot of time clearing the mess.
They tried to locate the spammer and intent legal actions, but the 
spammers have already disappeared at that time.

>  Given that, for example, huge chunks of the internet don't 

Open relays were quite widespread at a time, now there's only around 
250k of it, compared to the millions of mail servers, and most are 
referenced in anti-spam blacklist databases.

You can check some statistics at http://www.ordb.org/statistics/

RMX may follow the same evolution, we will know if we try it.

> non-spammers to do something is doomed to failure.

For getting mail, non-spammers have to do a lot of things, and they have 
no way not to do it and get working domains, namely :
- Get a domain name and pay for it.
- Get DNS servers that manage their domains
- Get MX records associated to the domain name
- Get the mail server listed on the MX records to be there and receive 
emails for the domain from the internet
- create the mail accounts
- maintain valid contacts for domain renewal

Do you feel that optionnaly maintaining an added RMX record would be too 
much ? For most domains it would be set to the MX and/or the network of 
the ISP customer.

> not well enough to enshrine into long-term standards, and useless the 

At least, it will stop domain names from being abused by spammers in 
 From headers. Spammers could today DDoS most mail servers on the 
internet with such a method, and noone seems to care.
If you talk to aol, hotmail or yahoo support and marketing teams about 
how bad their company is viewed by internet users due to forged from 
headers ("I receive plenty of spam from aol and hotmail"), and how much 
bounce/network overload they get related to spammers forgeries, you 
would see it would be a significant improvement already.

Spammers could always use reply-to for domains they have no 
authorization for, but that would matter quite less.

> argument to HELO matches the peer's rDNS domain name in some fashion.

The fact that it currently stop some spam is a side-effect, like if you 
say : I don't accept mail from people who have few mail server 
configuration skills (bad hostname) and/or who are on a network managed 
by someone with low network skills (bad or no rdns records).

If you prefer that point of view, this is almost equivalent to a 
blacklisting of the IP adresses listed on 
http://www.rfc-ignorant.org/how_to_ip.php

This heuristic is also in no way related to the server authority to send 
mail from a certain domain.

> never be widespread enough to enshrine into public standards.

This is an interesting point. If I understand you well, you say that 
spammers will choose domain names that have no rmx records to spam. Like 
when they use open relays.

This give a choice to the recipient.
For example, I can use to implement a email validity confirmation 
request (like tmda.net) for only domains who do not implement rmx 
records or are not blacklisted due to their spamming activity.
This suppress the burden of confirmation for correct domains.

I think (but I understand it may not be your choice) that we are not 
defining a tool that will be perfect or 100% efficient, but one that 
give us quite more control of what we (as mailbox users) choose to receive.

Pierre