Subject: [Asrg] Server banner tags

From: "John R Levine" <[email-masked]>
Date: 16 Mar 2003 23:09:23 -0500

A couple of years ago Paul Hoffman and I worked out a scheme of SMTP
banner tags that server owners could use to publish their spam policies.
Laws about bulk mail could then require that mailers obey the tags.

Every SMTP transaction starts with the server sending a banner like this:

220 some random text

RFC 2821 says nothing about the text other than that the total line length
including the CRLF at the end can't be longer than 512 characters.  Our
proposal defines some simple strings that a server puts in the banner to
specify both the policy and the location of the server so any clients can
tell what law applies.  For example:

220 MAIL.EXAMPLE.COM   NO UCE C=US L=CA

NO UCE means no unsolicited commercial email accepted, C=US L=CA specify
the country and state in X.500-ese.  Or it could say

220 MAIL.EXAMPLE.COM  NO UBE C=US L=NY

NO UBE means no unsolicited bulk mail, this time in New York.

That's it.  When sending mail through relays, the banner from the MX
server for the recipient's domain is the one that matters.  If a domain
has multiple MX servers, it's up to the domain's management to make the
banners consistent.

Mailers can either test the banners on the fly while sending mail, or they
can use a listwashing program that checks the banners for the domains in a
list.  We have both the draft proposal and some sample listwashing code
(not because we think it's a particularly good idea, but to show how easy
it is) at http://www.cauce.org/proposal/

Some people have suggested making the banner an ESMTP extension rather
than putting it in the initial tag.  We don't like that idea both because
there are still plenty of servers that don't do ESMTP and because it
requires more work from the server to display the tag, at least three
round trips rather than just one.

Some have asked what if mail goes through either an ISP's mail server or
stolen relays so the sender doesn't see the recipient's tag.  The answer
is tough luck, it's the sender's job to check the tag, either by using a
mailing service that checks tags or by listwashing.

The point of the tags is to strengthen the property rights approach to
mail management, that the server's owner gets to make the rules.  In
effect this is a global opt-out list, but one that scales in the number of
servers rather than the number of mailboxes and that distributes the
opt-out info rather than requiring a central registry.  We've had
considerable interest from state legislators in California and Ohio to
refer to this in state law, and I hope to plug it at the FTC spam fest
next month.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"I dropped the toothpaste", said Tom, crestfallenly.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Mon, 17 Mar 2003 08:55:55 -0500

>Laws about bulk mail could then require that mailers obey the tags.

The U.S. courts have already ruled that there is an assumption of 
knowledge by the spammer.  They are expected to understand that the 
recipient's AUP does not allow spamming--even if they have not read 
it.  This has been instrumental in a number of spammer court cases. 
For more details, see the legal talk by Jon Praed at the MIT Spam 
Conference (http://www.spamconference.org/praed.pdf) or better yet, 
watch the video 
http://web.mit.edu/webcast/spamconf03/mit-spamconf-s4-26100-17jan03-1600-80k.ram 
(34 minutes into the webcast).

Spamming is already illegal (at least from the standpoint of the 
ISP/Spammer relationship it constitutes trespassing--an illegal use 
of property).  Unfortunately I suspect it costs more to bring a case 
to suit than you get in return.  The existing cases I think have been 
prosecuted mainly as a deterrent.  (I asked Jon Praed what an average 
suit cost, but he wouldn't give me a direct answer.)
-- 
Kee Hinckley
http://www.puremessaging.com/        Junk-Free Email Filtering
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "John R Levine" <[email-masked]>
Date: 17 Mar 2003 09:48:52 -0500

> Conference

I'm pretty sure that in all the cases listed in his slides, the ISP had
sent a regular paper notice to the spammer telling him to stop.  I've
helped draft a few state anti-spam laws, and the issue of notice to the
spammer is definitely an open one.

A couple of proposed laws, one of which may have been passed, had much
uglier notice provisions, like putting it on the home page with the same
name as the email address, for some ill-defined definition of "same name".
Banner tags are way better than that.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Sewer Commissioner
"More Wiener schnitzel, please", said Tom, revealingly.

---

From: Matt Sergeant <[email-masked]>
Date: Mon, 17 Mar 2003 14:45:17 +0000

On Monday, Mar 17, 2003, at 13:55 Europe/London, Kee Hinckley wrote:

> ISP/Spammer relationship it constitutes trespassing--an illegal use of 
> property).  Unfortunately I suspect it costs more to bring a case to 
> suit than you get in return.  The existing cases I think have been 

I asked him if it was profit making, and he said yes (just). But he did 
qualify it with that wasn't the point - the point was to stop the 
spammer permanently.

Matt.