Subject: Re: Mail-Transmitter RR

From: "Eric A. Hall" <[email-masked]>
Date: Sun, 02 Jun 2002 12:49:16 -0500

Paul Vixie wrote:

> We would be overloading SRV just as much as the current proposal does MX.

Moreover, it overloads SRV in a bizarro way, defining a client rather than
a server. Avoid mangling the interpretation of SRV please, adoption is
slow enough as it is.

> More to the point, the patch to sendmail to implement MAIL-FROM is less
> than 100 lines if MX is used.

MX is not flexible enough by itself. At the very least, you also need a
way to map PTR space to the sender domain such that EG anybody with a PTR
of ehsco.com. is hereby authorized by me to send mail from @ehsco.com.[1]
Also, having the ability to define specific hosts lets mobile users setup
user.domain.dom mail domains on a dynamic basis, so you need a way to map
in A/AAAA RRs as well.

I think that all of the above illustrates why you really need a new RR
using codes (as in the mail I forwarded earlier), rather using a static
owner name.

[1] Two subordinate issues with PTRs. First of all, there must be a
mandatory forward-path verification of the PTR data, otherwise any idiot
can add a PTR to their in-addr space and spoof me, which solves nothing.
Second, remember that this option would only be definable by the owner of
the domain, so it couldn't be used as a casual attack even when the
forward lookups were not used.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: Allan Liska <[email-masked]>
Date: Sun, 2 Jun 2002 21:53:27 -0400

Hello,

Sunday, June 02, 2002, 12:50:07 PM, Paul wrote:

PV> I've strengthened the wording on [MAILFROM 2.2] which now reads:

PV>    2.2. Second-stage relays such as ISP mail servers are often used and can
PV>    be described by adding as many relays as necessary to the MAIL-FROM MX
PV>    RRset.  In our example, if ISC sometimes used UUNET for outbound mail
PV>    services, the DNS data describing this relationship might be as follows:

PV>       $ORIGIN isc.org.
PV>       MAIL-FROM MX 0 rc
PV>                 MX 0 rc1
PV>                 MX 0 uunet.uu.net.

PV>    Let it be noted that a domain owner's power to repudiate forged e-mail
PV>    is only as strong as the security policy of its registered inbound and
PV>    outbound mail relays, and that if such a relay is (for example) open to
PV>    third party relay, then no value will be added by registering a domain
PV>    MAIL-FROM MX containing that relay, and no inbound MAIL-FROM checking
PV>    will be possible on final delivery relays for a domain @ MX containing
PV>    that relay.  Multistage relays (both inbound and outbound) are a
PV>    breeding ground for anonymity unless they are very carefully configured.

PV> I think that there's a LOT of help to be had from this, amongst anonymous
PV> but cooperating domain owners and relay owners.  I'm not pushing this as
PV> the one true way to stop all spam for all time, because I don't think there
PV> is any such.  It's an optional, low-impact way to protect folks like hotmail
PV> from widespread forgery.  Probably it won't slow spam down one whit, but it
PV> will reduce the overall injury from spam.

There are a couple of problems I see with this.  One may not be a
problem at all, but here goes.

In the example you used above, and I am sure this is the same with
many large ISPs, UUNET's mail server, mail.uu.net, is actually 5
different machines:

mail.uu.net.            300     IN      A       199.171.54.106
mail.uu.net.            300     IN      A       199.171.54.122
mail.uu.net.            300     IN      A       199.171.54.245
mail.uu.net.            300     IN      A       199.171.54.246
mail.uu.net.            300     IN      A       199.171.54.98

If I add mail.uu.net as one my MAIL-FROM records, but the server
delivering the message is actually ashd1-2.relay.mail.uu.net, is that
message going to be rejected?  I don't imagine most DNS
"administrators" will know that mail.uu.net is really multiple
servers.

Secondly, doesn't this have the potential to be abused by mail
administrators that only kinda-sorta know what they are doing?  If a
mail administrator decides s/he doesn't want to accept mail from
anyone without a MAIL-FROM record, then it is no longer a voluntary
action.  Or is that not going to be part of the functionality?

I hope these made sense.

allan
-- 
allan
[email-masked]
http://www.allan.org

---

From: Ted Lemon <[email-masked]>
Date: Mon, 3 Jun 2002 11:28:32 -0500

[ post by non-subscriber.  with the massive amount of spam, it is easy to
  miss and therefore delete mis-posts.  so fix subscription addresses! ]

So do you have a patch to sendmail that implements this draft?   :')