Subject: Re: [Asrg] 0. General - anti-harvesting (was Inquiry about CallerID Verification)

From: Bart Schaefer <[email-masked]>
Date: Mon, 1 Dec 2003 09:39:31 +0000

On Dec 1,  6:54pm, Brett Watson wrote:
}
} Let me see if I can summarise the crux of the matter, here.
} 
} Regardless of what the RFCs say about return address validity, it
} seems like a reasonable local policy to reject mail that has an
} invalid return address.
} 
} The problem arises in actually determining the validity of any address.

The real question, as Yakov has asked repeatedly, is what benefit is
gained from validating the address rather than validating the source
of the message?

Hector responds that there is benefit now in using SMTP to validate the
address, because it doesn't require any additional protocols for source
validation, and that in turn is the case because the existing protocol
requires that the sender mailbox be deliverable.

} Or am I misunderstanding this argument?

I dispute that the existing protocol supports Hector's position.  As I
said in another message, I also dispute that VRFY can be adapted for this
purpose in any useful way.

This is not the same as disputing the policy of rejecting mail that can't
be validated.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Mark E. Mallett" <[email-masked]>
Date: Mon, 1 Dec 2003 05:37:08 -0500

On Mon, Dec 01, 2003 at 03:51:40AM -0500, Hector Santos wrote:
> 
> Compliant servers must support VRFY as a way to validate return address.

(BTW, "must be valid" and "must be verifiable" are two different
things.)

There are various legitimate situations in which VRFY or RCPT TO
verification wouldn't presently work.  These would have to be solved.
For example:

- UUCP (mentioned elsewhere in this long thread.)  The host system
  doesn't have any chance of verifying users behind the UUCP connection.
  You'd get false positives here.

- As with UUCP, other sorts of disconnected delivery systems where the
  receiving MTA doesn't know anything about the usernames attached to
  a domain.  e.g. the user who has a catchall box for all
  [email-masked] addresses, who periodically accesses that box and
  applies local filtering rules.  The user who just has a single
  maildrop from which mail is retrieved via something like fetchmail
  (or a number of equivalents).  Again, false positives.

- The recipient address that is only valid under certain circumstances
  (e.g. graylisted, or firewalled such that it only accepts mail from
  certain sources, or has a filter installed such that it only
  accepts mail from certain senders).  False negatives here.

- The system that accepts all mail so that it can update its
  'corpus' of spam mail.  False positives.

That's just a few.  A more imaginative mind can probably think of
many others.

Maybe they can be solved by extending the capabilities of VRFY,
but I doubt they can be solved by changing usage behaviour.
What would be another way?

-mm-