Subject: [Asrg] Proposal: MTA whitelisting using DNSbls

From: Walter Dnes <[email-masked]>
Date: Mon, 28 Jul 2003 00:43:10 -0400

I'm not an expert on DNS, and I don't know how difficult the
following would be, but here goes...

Pre-Amble
=========
   A lot of today's spam comes from compromised home machines.  DNSbls
of dynamic IP address allocations attempt to list these ranges, but are
having extreme difficulty keeping up with ever-expanding allocations.
The basic problem is that there are hundreds of millions, if not low
billions, of dynamic IP addresses, and a much smaller number of MTAs
which should be sending email.  Attempting to keep track of dynamic IP
addresses is doing things "the hard way".  It would take much less
effort to keep track of authorized senders within a range op IP addresses.
RMX and similar proposals attempt to address this problem, but would
require structural changes in bind and in DNS client software, which
makes acceptance and implementation problematical.

The Proposal
============
   I propose additional functionality in DNSbls.  The best explanation
is via example.
   - assume the existance of DNSbl mta_list_zone.tld
   - assume that your MTA is contacted by a machine with IP address
     10.9.8.7 and rDNS of really.bad.example.com.

   Your MTA would do a DNS query for
 really.bad.example.com.7.8.9.10.mta_list_zone.tld

   The DNSbl would implement the following logic...
   - if address 10.9.8.7 is in the list of authorized MTAs, the return
     value would be 127.0.0.2, i.e. OK to accept
   - if address 10.9.8.7 is not in the list of authorized MTAs, and
     mta_list_zone.tld considers itself authoratative for either
     bad.example.com or example.com, the return value would be
     127.0.0.3, i.e. recommend rejection
   - if address 10.9.8.7 is not in the list of authorized MTAs, and
     mta_list_zone.tld doesn't consider itself authoratative for either
     bad.example.com or example.com, the return value would be
     127.0.0.4, i.e. don't know

Advantages
==========
   - Like RMX etal, this proposal would require keeping track of far
     fewer addresses than dynamic IP address DNSbls.
   - Unlike RMX etal, it would not be necessary to register your domain
     with the list.  Using an authorized MTA would be sufficient
   - Unlike RMX etal, no new DNS records or changes to bind or DNS
     client software would be required.  All the changes would be in MTA
     filter/blocking plugins (milter, etc) and DNSbls.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 28 Jul 2003 22:36:36 +0200

> following would be, but here goes...

Wouldn't it be easier to avoid the centralized concept and use a
decentralised like
  https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06115.html
instead.
However it requires administration of reverse DNS space (in-addr.arpa)
which is kinda out of fashion these days.

The biggest problem with your proposal I see in the process of becoming
"whitelisted".

Another proposal that uses existing DNS infrastructure but suffers from
the "forward" problem just like RMX is SPF:
    http://spf.pobox.com/

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: Walter Dnes <[email-masked]>
Date: Mon, 28 Jul 2003 22:53:01 -0400

On Mon, Jul 28, 2003 at 10:36:36PM +0200, Markus Stumpf wrote
>   https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg06115.html

  No more centralized than today.  You can choose from BOFH DNSbls or
"kinder/gentler" DNSbls today.  My proposal is about enhancing DNSbl
functionality.  You should still be able to pick and choose amongst
several choices.

> The biggest problem with your proposal I see in the process of
> becoming "whitelisted".

  The ISP provides the list.  If a consumer ISP doesn't know what IP
addresses its MTAs are using, this is probably the least of their
problems.

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 29 Jul 2003 21:33:52 +0200

> addresses its MTAs are using, this is probably the least of their

So what are the rules to get added to the list?
With DNS*BL* it's easy. The IP fails the criterion of the DNSBL and is
added. It fixes the problems gets retested and removed.

But who is responsible for the centralized whitelisting DNSWL?
Will it be used as a pressure against some Mailservers? (We don't like
you, we don't like your content, we don't like your users?).

	\Maex