Subject: [Asrg] SPF is only useful to dupe the ignorant...

From: Barry Shein <[email-masked]>
Date: Fri, 10 Sep 2004 15:43:29 -0400 (EDT)

Spammers no longer use static domains, and they haven't for years.

Spammers us ZOMBIE PCs.

These are virus-infected PCs which let spammers do whatever they like
with them, such as cause those PCs to send out millions of e-mail
messages.

So, you get an e-mail from [email-masked] and it's
SPF OK.

But you see that it's spam when you read it.

What are you planning to do with this information? Block all of AT&T?

This (zombie pc's) is how the vast majority, maybe >95%, of the spam
today is sent.

The next tiny step, already being done, is for the spamemr to just use
the zombie pc's assigned host/domain, such as in my example, in the
MAIL FROM.

Of course, SPF does nothing to check the From: header which is what
the recipient sees, so it can say whatever it likes. Particularly
since it "passed" SPF.

With all due respect the discussion here seems to arise from people
who may know something about computers, about how SMTP works,
software, even some stuff about SPF, obviously have received some spam
and glanced at it, but show breathtaking ignorance about how spammers
actually operate and just seem to make it up on the fly.

Maybe we shuold work on that, come to some common understanding of how
spammers operate, BEFORE arguing the viability of some proposed
technical approach.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 10 Sep 2004 16:19:17 -0400 (EDT)

> So, you get an e-mail from [email-masked] and it's

Why do you think ATT is going to publish SPF records for
adsl-24-73-19-222.att.net?  Do you think they _want_ to validate
outgoing email from that domain?

Seth

---

From: "Eric S. Raymond" <[email-masked]>
Date: Fri, 10 Sep 2004 17:21:30 -0400

> Spammers no longer use static domains, and they haven't for years.

That's right.  They joe-job my domain instead, and I get over a 
thousand bogus bounces a day.  If SPF deployment does nothing but stop 
that (which it can), it's a win.  Meng has picked this piece of the
problem and is addressing it effectively.

Zombie nets are a different problem to be solved with different methods.
That will require taking down Microsoft and obsolescing Windows.  I'm working
on that part.

Meanwhile, you're not an idiot, Please do us all a favor and stop imitating
one so effectively.  Lead, follow, or get out of the way.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Barry Shein <[email-masked]>
Date: Fri, 10 Sep 2004 19:32:30 -0400

It's their dsl customer, why wouldn't they?

Now, just like blocking port 25 etc some ISPs might choose to not
publish SPF records for their dynamic and static pool customers.

But that's nothing to do with the SPF spec, per se, and my guess is
that without some external force (unlikely) you'll have billions who
do, and billions who don't.

-- 
        -Barry Shein

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 10 Sep 2004 19:48:44 -0400 (EDT)

> It's their dsl customer, why wouldn't they?

Because they do NOT want to encourage email coming from it, that's
why.

There is absolutely _no_ reason to publish an SPF record for any IP
address you don't want to authorize to emit email that claims to be
 from your domain.

> do, and billions who don't.

Somebody who publishes SPF records for spammers will quickly find all
of their SPF records untrusted, which is not a good position to be in.

Seth

---

From: Barry Shein <[email-masked]>
Date: Fri, 10 Sep 2004 19:43:51 -0400

> problem and is addressing it effectively.

So now SPF is mostly useful for people with vanity domains who run
SMTP for those vanity domains?

Which is getting down to a pretty microscopic portion of the
community.

My honest opinion is that SPF is a poorly-thought out idea which has
now developed into a massive fraud. I guess not out of evil intentions
but just the thrill of getting some attention and regretting that it's
all falling apart.

Unfortunately, SPF is not only a fraud, it's a dangerous fraud.

What it's doing is introducing widespread authentication (PAPERS
PLEASE!) without any obvious or widespread benefits to even remotely
match.

As a friend of mine said about airport security: It's a damned good
thing Reid didn't hide the explosives in his underwear! But, one guy
slips some semtex in his shoes and people have to get their shoes
searched, as if there's some magic to shoes.

No, SPF is not only mostly useless and ill-conceived, it has a
dangerous civil liberties aspect to it that goes beyond, e.g.,
anything I have to do to mail a paper letter or make a phone call.

So I, and everyone else, has every right to demand to know, and
examine carefully and critically, what the benefit is before we're all
asked to show our identification every time we want to send an email.

If the benefits were great, swell, life is full of trade-offs, I'm not
saying the concept crosses some pre-determined line.

But if the benefits are so thin and vaporous I say to hell with it and
let's go back to the drawing board and stop distracting ourselves (and
the media et al) with this sort of fool's gold.

-- 
        -Barry Shein

---

From: John Levine <[email-masked]>
Date: 11 Sep 2004 00:23:35 -0000

>It's their dsl customer, why wouldn't they?

I am not a big fan of SPF, but it sounds like you're misunderstanding
what it does.  SPF is a map from the domain in a bounce address to a
set of IP addresses.  The SPF entry for worldnet.att.net or for
att.net is going to list AT&T's outbound mail servers, not the whole
DHCP farm.  There probably wouldn't be an entry for adsl-24-73-19-222.att.net
since you don't see much mail from [email-masked].

One thing that SPF doesn't do very well (nor do most of its
competitors) is to provide an efficient way to denounce mail from your
subdomains.  It's easy enough to say no mail, that's "-all", but you
have to put the SPF record on every subdomain that a bad guy might
use.  You can try to use DNS wildcards, but you still need an SPF
record for each name for which you have an A record or anything else,
so the DNS bloat is severe.

This isn't SPF's worst problem, the large amount of real mail that it
marks as bogus is much worse.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Information Superhighwayman wanna-be, http://www.johnlevine.com, Mayor
"I shook hands with Senators Dole and Inouye," said Tom, disarmingly.

---

From: Seth Breidbart <[email-masked]>
Date: Fri, 10 Sep 2004 20:55:51 -0400 (EDT)

> SMTP for those vanity domains?

No, it's useful for anybody with a domain who doesn't want to receive
bounces for forgeries of his domain.  That includes, for instance,
mail.com; big enough for you?

> PLEASE!) without any obvious or widespread benefits to even remotely

The benefit is that nobody can get away with forging email from my
domain unless he can actually send it from an IP address I've
authorized it to emanate from.  I think that's good.

If I ran an ISP, I wouldn't authorize every dialup luser to emit mail
with my name, I'd authorize only my mailservers.  The lusers can send
mail via the mailserver; that's what they're supposed to do.

> anything I have to do to mail a paper letter or make a phone call.

If you don't claim to be from my domain, my SPF record has nothing to
do with you.  The recipient always knows the IP you're sending from,
and the domain you _claim_ to be.  The only thing SPF adds is the
ability for the owner of that domain to specify whether or not that IP
is _authorized_ to send email for (from) that domain.

> asked to show our identification every time we want to send an email.

You're showing the same information.  Whether or not SPF is published
is up to the domain owner.  Whether or not and how the result of an
SPF check is applied is up to the recipient, as always.

> But if the benefits are so thin and vaporous I say to hell with it

So ignore it.  But please don't send me bounces for forged mail that
came from IP addresses I didn't authorize to send mail from my domain,
lest you be considered a spammer.

Seth

---

From: Bill Cole <[email-masked]>
Date: Fri, 10 Sep 2004 21:10:06 -0400

>Spammers no longer use static domains, and they haven't for years.

Some still do, but they are untouched by SPF anyway.

>Spammers us ZOMBIE PCs.

Yes, and those are quite hard to get into SPF records.

>So, you get an e-mail from [email-masked] and it's

Why would AT&T create an SPF record for that name?

The more common scenario NOW is that the mail is offered with an 
envelope sender in some other domain. For many months one persistent 
zombie spammer seemed fixated on using msn.com addresses. In digging 
through the few of these that get past the Spamhaus XBL and my local 
list, the latest example shows these headers:

Return-Path: [email-masked]
Received: from adsl-67-126-181-243.dsl.lsan03.pacbell.net 
([67.126.181.243] verified)
   by sc1.scconsult.com (Stalker SMTP Server 1.8b9d14)
   with SMTP id S.0000673452 for <[email-masked]>; Wed, 08 Sep 
2004 21:05:55 -0400

I find it extremely unlikely that Verizon is ever going to create a 
SPF record including an LA dynamically-assigned DSL address owned by 
SBC.

More likely is that the spammers using zombies will follow the Atriks 
example and create DNS records in their own domains pointing at their 
hijack victim machines.

The trick to handle that is not obvious, but works great in a 
reactive way: don't let your MTA resolve names served by the 
slimeballs.

-- 
Bill Cole
[email-masked]

---

From: Bill Cole <[email-masked]>
Date: Fri, 10 Sep 2004 21:19:47 -0400

>It's their dsl customer, why wouldn't they?

1. It imposes a direct cost for them to do so.
2. An SPF record is a statement that the name is a valid one for an 
email address, but for that to be true the customer in question would 
in the overwhelming majority of such cases (i.e. anyone on a 
residential cable modem or DSL line handled by any major provider) be 
in direct violation of their service terms.

-- 
Bill Cole
[email-masked]

---

From: Bill Cole <[email-masked]>
Date: Fri, 10 Sep 2004 21:30:40 -0400

At 7:43 PM -0400 9/10/04, Barry Shein  imposed structure on a stream 
>Which is getting down to a pretty microscopic portion of the

It's also quite useful for owners of the more commonly forged domains 
such as AOL, Microsoft, Earthlink, and non-ISP companies whose brand 
recognition makes them common  targets.

Not such a microscopic portion. Frankly I find the last one most 
useful because I work in that realm and frankly could not care less 
about the ongoing viability of cheap mass-market consumer ISP's. I do 
care about the daily myriads of bogus bounces hitting systems I have 
to keep running and what they imply about how widely garbage mail is 
claiming to be from my employer.

-- 
Bill Cole
[email-masked]

---

From: Barry Shein <[email-masked]>
Date: Fri, 10 Sep 2004 21:17:39 -0400

> since you don't see much mail from [email-masked].

Who says you (the public "you") don't see much mail from
[email-masked]?

I see bazillions of msgs per day from addresses like that here. Much
of it non-US (so let's not quibble .att.net, it's more likely to be
.tiscali.nl or .chello.de or ocn.ne.jp etc).

So let's say they have 2 million dhcp pool customers (dsl, ppp, cable)
who for years have been sending out mail directly which automatically
gets addressed as [email-masked].

They haven't opted to block port 25, quite possibly because they don't
have the infrastructure to support that relaying and don't want to
build one, BUT WHATEVER, policy, that's their marketing (I know of one
cable provider who seems to, well, not quite promise, but sell on
never blocking port 25 but I guess these things change.)

So as SPF is deployed what happens?

Either SPF records are published for all of them, or maybe somehow
only those which need it, or slowly but surely these customers find
their email seemingly randomly rejected because of SPF NAKs and now
have to understand this and react to it?

What a joy that'll be for the support desks.

Has anyone worked any of this out? Why do I get the feeling that, at
this rather late date in SPF's devpt, that all these questions remain
unanswered?

 > marks as bogus is much worse.

I agree this isn't SPF's worst problem, but there's something here
that does need to be explored.

-- 
        -Barry Shein

---

From: Florian Weimer <[email-masked]>
Date: Sat, 11 Sep 2004 11:06:51 +0200

> So, you get an e-mail from [email-masked] and it's

No, this is not the way SPF works, and it's also not the way spammers
will comply with its requirements.

Nowadays, a sizable chunk of all botnet-centered spamming activity
already uses dedicated second level domains to provide a DNS name for
the controlling IRC server.  Registering a few additional domains to
send mail from domains with valid SPF records is a trivial step.  You
can even generate SPF records dynamically with a narrow scope so that
these records are not distinguishable from legitimate ones.

In theory, SPF fixes the bounce problem.  But this requires
significant deployment, and this is not going to happen.  Only badly
configured MTAs (or poorly outdated MTA software such as qmail) send
NDRs for unknown users or messages containing malware.  These MTAs
won't get magically fixed once there's a new RFC.

---

From: Bill Cole <[email-masked]>
Date: Sat, 11 Sep 2004 09:56:35 -0400

At 11:06 AM +0200 9/11/04, Florian Weimer wrote:
>  Only badly
>NDRs for unknown users

That's not really true. There are a lot of situations where a 
world-facing MX is not the final delivery point or last transport hop 
for mail and in any such situation it is possible for delivery 
failures to occur later on. It would be a serious blow to the 
reliability and deterministic behavior of mail for all complex mail 
systems to forego bounces.

>  or messages containing malware.

Accepting a message and later bouncing it based on any determination 
that the content indicates that the sender is untrustworthy is a 
gross misdesign. That goes for malware or spam filters. If the 
messages cannot be scanned at the border synchronously with the SMTP 
session (i.e. in the DATA phase) and rejected at that point, any bad 
content determination made later should extend to  distrust of any of 
the standard RFC282[12] indications of who sent it.

I believe that reality is a bad thing for mail. There are cases where 
the sender on spam or malware mail is not forged or where the 
determination of ill-intentioned content is in error. Bouncing those 
would make sense. Unfortunately it is impossible for filters to know 
when they have misfired or for malware filters to be 100% certain 
that a 'signature' match provides assurance of what the discovered 
malware is or does. SPF and other MARID schemes could make it much 
safer to generate such bounces and be assured that they are not 
targeted at innocent parties.

>  These MTAs

Some systems where the bad bounces are a matter of necessity rather 
than misdesign can certainly be 'fixed' by a usable mechanism for 
validating envelope senders synchronously at the border. The 
robustness issues involved with ordaining that all mail receiving 
systems implement all of their reasons for not delivering mail 
synchronously at their exterior borders are real and can override 
concerns over occasional misdirected bounces. MARID schemes, 
including SPF, offer relatively lightweight ways to reduce the chance 
of misdirected bounces.

I'm a bit surprised that memories are so short. It is not so long ago 
that a large fraction of spammers were using completely bogus domains 
in envelope sender addresses. For a while this meant that early 
adopters of the practice of validating the theoretical mailability of 
domain parts could reject large amounts of spam before the DATA phase 
with total assurance that every rejection was justified. Spammers 
adjusted by switching to forged addresses and the tactic of using a 
whole lot of different disposable domain names of their own. The 
latter is a dead end for them, and it would be very helpful (at least 
until they figure out some other approach) to close off the option of 
forgery.

I wish there was a better alternative to an arms race, but I don't 
think there is. Arms races are not always eternal and don't always 
end badly.

-- 
Bill Cole
[email-masked]

---

From: Tony Finch <[email-masked]>
Date: Mon, 13 Sep 2004 14:59:45 +0100

"Eric S. Raymond" <[email-masked]> wrote:
>that (which it can), it's a win.

SPF will do very little to eliminate the bad effects of joe jobs. It
requires too much co-operation from all over the Internet, most of which
doesn't care enough. If you want to reliably eliminate backscatter,
use BATV which requires no help from anyone else.

>Zombie nets are a different problem to be solved with different methods.

It's reasonably possible to identify zombie networks with intrusion
detection techniques, identifying machines that emit viruses and run
spamware. They can then be blocked.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
LANDS END TO ST DAVIDS HEAD INCLUDING THE BRISTOL CHANNEL: EAST 4 OR 5,
VEERING SOUTHEAST 3. THUNDERY SHOWERS LATER. GOOD, BECOMING MODERATE OR POOR
WITH FOG PATCHES IN SOUTH. SLIGHT, OCCASIONALLY MODERATE AT FIRST.

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 13 Sep 2004 17:07:33 +0200

Tony Finch wrote:

> SPF will do very little to eliminate the bad effects of joe
> jobs. It requires too much co-operation from all over the
> Internet, most of which doesn't care enough.

That's not how it works.  Some big ISPs like AOL and some
popular anti-spam tools like SA support it.  Therefore the
spammers cooperate (they want to reach their victims at AOL,
and they want to bypass SA).
                             Bye, Frank

---

From: Barry Shein <[email-masked]>
Date: Mon, 13 Sep 2004 17:28:03 -0400

Well, first, I commend you for indicating that you are actually
knowdgeable about how spammers are operating currently, on this list
it's like a breath of fresh air.

But I'm still confused as to why someone with one of those bazillions
of assigned host names won't possibly have a matching SPF record?

Most responses thus far say it's not a LIKELY policy (of the ISPs)
which leaves me wanting because what do they know what LIKELY policies
might arise?

I could just as easily argue that the same ISPs wouldn't possibly
tolerate thousands of zombie PCs because "obviously" it'll eat up
their bandwidth and cause lots of complaints etc, BUT HERE WE ARE!

So much for modeling the world in one's head by application of common
sense.

Anyhow, if someone might indulge me a technical reason that doesn't
rely on my accepting their projection of the ``mens rea'' of a major
ISP's marketing professionals I'd appreciate it.

-- 
        -Barry Shein