Subject: [Asrg] Request for MS CID XML samples...

From: Barry Shein <[email-masked]>
Date: Wed, 3 Mar 2004 22:07:17 -0500 (EST)

I realize that the "Caller ID for E-Mail" paper has some contrived
examples but I was hoping I could prod Microsoft and/or Sendmail to
work up and publish current examples of what their actual MS CID XML
records would look like right this minute if MS CID were in use.

It'd be interesting to see real-life examples for msn.net,
microsoft.com, and sendmail.com for study.

Thank you.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 03 Mar 2004 22:50:23 -0500

> microsoft.com, and sendmail.com for study.

Barry,

Welcome back. The key is to look for "_ep.domain..." - the following are 
real life examples (as of 5 minutes ago):

1. For Hotmail:

_ep.hotmail.com text =

"<ep xmlns='http://ms.net/1' testing='true'><out><m><indirect>list1._ep.
hotmail.com</indirect><indirect>list2._ep.hotmail.com</indirect><indirect>list3.
_ep.hotmail.com</indirect></m></out></ep>"

2. For Microsoft:

_ep.microsoft.com       text =

"<ep xmlns='http://ms.net/1' testing='true'><out><m>"

"<mx/><a>213.199.128.160</a><a>213.199.128.145</a><a>207.46.71.29</a><a>
194.121.59.20</a><a>157.60.216.10</a><a>131.107.3.116</a><a>131.107.3.117</a><a>
131.107.3.100</a>"

"</m></out></ep>"

3. For Amazon:

_ep.amazon.com  text =

"<ep xmlns='http://ms.net/1' 
testing='true'><out><m><r>207.171.160.0/19</r></m></out></ep>"

Yakov

---

From: Barry Shein <[email-masked]>
Date: Thu, 4 Mar 2004 16:31:55 -0500

me...
> microsoft.com, and sendmail.com for study.

Ok, teach a man to fish: dig -t txt _ep.microsoft.com

The record I get back right now from microsoft.com is (reformatted
slightly by me for ease of reading):

  <ep xmlns='http://ms.net/1' testing='true'><out><m>"
    "<mx/>
    <a>213.199.128.160</a>
    <a>213.199.128.145</a>
    <a>207.46.71.29</a>
    <a>194.121.59.20</a>
    <a>157.60.216.10</a>
    <a>131.107.3.116</a>
    <a>131.107.3.117</a>
    <a>131.107.3.100</a>"
  "</m></out></ep>"

However, looking through our logs I see that in the past 24 hours or
so we've received email from [email-masked] from the following
hosts which do not appear in that list:

      207.46.248.64       delivery.pens.microsoft.com
      207.46.248.65       delivery.pens.microsoft.com
      207.46.248.66       delivery.pens.microsoft.com
      207.46.248.67       delivery.pens.microsoft.com
      207.46.248.69       delivery.pens.microsoft.com

      131.107.3.121       mail5.microsoft.com
      131.107.3.124       mail2.microsoft.com
      131.107.3.126       mail6.microsoft.com

and, perhaps an interesting case:

      209.11.164.116      mh.microsoft.m0.net

interesting because m0.net is probably being paid to send e-mail
marketing on behalf of microsoft so the only way they'd be getting
through in this new regime would be if microsoft listed them as
authorized in their _ep record.

I suppose they (m0.net) could use the Sender: or similar alternative
but looking at an actual example I see that they (m0.net) do not. So
it'd have to be in microsoft.com's list and as far as I can tell it's
not.

So, anyone want to take a reasonable stab at these discrepancies?

By reasonable, I'm hoping for something more than "maybe the _ep
record was different when those msgs flew" because that doesn't seem
likely given the actual examples, unless you know this for a fact.

Is the microsoft.com record complete or not?

Or am I misunderstanding something?

And, if it's not complete, why not and, to reiterate my original
request, what would a complete record look like?

Thank you.

-- 
        -Barry Shein

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 04 Mar 2004 18:02:25 -0500

Barry Shein wrote:

> ....

> ....

Barry,

All of these messages, did they have @microsoft.com in their MAIL FROM 
or in the "From" header of the message itself?

Yakov

---

From: "Tom Bartel" <[email-masked]>
Date: Thu, 4 Mar 2004 16:46:07 -0700

As I understand it, the " testing='true' " parameter in the opening tag,
as defined in the spec, indicates that the data presented in the record
is to be assumed as an incomplete listing.

Tom Bartel
303.642.4104

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Barry Shein
> Sent: Thursday, March 04, 2004 2:32 PM
> To: [email-masked]
> Subject: [Asrg] Re: Request for MS CID XML samples...
> 
> 
> 
> me...
Purveyors to the Trade | Voice: 617-739-0202        | Login:
617-739-WRLD
The World              | Public Access Internet     | Since 1989
*oo*

---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.596 / Virus Database: 379 - Release Date: 2/26/2004

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.596 / Virus Database: 379 - Release Date: 2/26/2004

---

From: "denny" <[email-masked]>
Date: Fri, 5 Mar 2004 10:05:40 -0500

> From: [email-masked] [mailto:[email-masked]] On Behalf Of Tom
> Bartel
> Sent: Thursday, March 04, 2004 6:46 PM
> To: 'Barry Shein'; [email-masked]
> Subject: RE: [Asrg] Re: Request for MS CID XML samples...
> 
[denny] 

Not sure if this is what the deal is but I can say that about 2 months back
I was talking to a local Microsoft rep at a tech event and I asked him about
the email that comes from MS....
He claimed that as far as he knew they had fixed the emails to all come from
*Microsoft.com
Like delivery.pens. and other hosts under the ms domain.

But for example www.gotdotnet.com which is run by ms still is not fixed and
they say that (as of about a month back) they it's going to be fixed to map
right.

So it may be in part the effect of having like 10,000 email hosting deals to
"round up" and fix....

And yea m0.net sends stuff for a bunch of legit businesses but gets in the
spam lists also....

I'd try to contact the channel that sent the *.m0.net mail and tell them to
get it moved....

About 6 months back I had a *LOT* of ms stuff in my blacklist email boxes
all the time. I'd say that now it's just a few... I think they are fixing it
as best they can given the volume of programs they run.