Subject: Re: Mail-Transmitter RR

From: [email-masked]
Date: Sun, 02 Jun 2002 11:24:30 +1000

Email addresses are tied to individuals not machines.  I don't
	think anyone wants to give up sending email as themselves from
	a arbitary machine.  Without the will to give this up you won't
	reach the critical match to make this idea work.

	SPAM is a political problem and as such technical solutions won't,
	in general, work.

	Mark
--
Mark Andrews, Internet Software Consortium
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Al Costanzo" <[email-masked]>
Date: Sat, 1 Jun 2002 21:30:30 -0400

Hi,

The draft needs work but its a -- good concept -- you could add code the
mail agent to look for the RR record.

I think this will need to be discussed on the SMTP side of the house first
because a RR does nothing if the mail protocol does not use it IMHO.

Regards,

Al
----- Original Message -----
From: "David Green" <[email-masked]>
To: <[email-masked]>
Sent: Saturday, June 01, 2002 8:49 PM
Subject: Mail-Transmitter RR

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
>
> I'm sorry if this is off-topic, but I couldn't find a working group that
> is working on dealing with spam, so this is the closest match I could
> find. I know this is in no way related to IPv6 or anything else you guys
> are working on, but it is an idea I had involving the addition of a RR
> type. If this is not the right place to be sending this, any pointers to
> other working groups/forums would be greatly appreciated. And I appreciate
> all of the hard work you guys are doing... My idea is attached
> (domauth.txt)
>
> Thanks,
>
> David Green
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.0.6 (GNU/Linux)
> Comment: For info see http://www.gnupg.org
>
> iD8DBQE8+WuwCi6CzkbyeRQRAhgwAKCMt8l88znXNKkC2QQMFAcsKCApsACggDIn
> 8dBjMHAeIVCIinb/g4HKyEE=
> =s/yu
> -----END PGP SIGNATURE-----
>
>

---

From: "Eric A. Hall" <[email-masked]>
Date: Sat, 01 Jun 2002 21:54:09 -0500

David Green wrote:

>                   Name: domauth.txt
>    domauth.txt    Type: Plain Text (TEXT/PLAIN)
>               Encoding: BASE64

This comes up every few months. Welcome to the club.

See draft-church-dns-mail-sender-01.txt as another approach, and one that
considers how to deal with roadblock relays.

See the attached message for some ideas on getting more mileage out of a
single RR (such as allowing an org to declare their entire reverse PTR
space as valid relays).

See the [email-masked] archives for flames, accusations, innuendos, and
unsupported arguments against it. Some people are very opposed to it.

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

Subject: Re: authenticating the source of mail
From: "Eric A. Hall" <[email-masked]>
To: [email-masked], [email-masked]
Date: Fri, 17 May 2002 12:36:49 -0500
List-Id: <ietf-822.imc.org>

More thinking on this, probably the best approach here is to define a
flags sub-field in the MS RR, which allows for domain indirection.

Two flags which could be used right away:

   bit 1 off=value refers to a host
          on=value refers to a domain

   bit 2 off=use A/AAAA RRs associated with value
          on=use MX RRs associated with value

Combining these flags would allow for various functions, with a minimal
amount of overhead. Some examples below.

Use the IP addresses associated with outbound.example.com as the
authorized relay servers for example.com:

 [Answer Section]
  example.com.           MS   0   outbound.example.com.

 [Additional-Data Section]
  outbound.example.com.  A    10.0.0.3

Use the MX RRs associated with mail.example.com as the authorized relay
servers for example.com:

 [Answer Section]
  example.com.           MS   3   mail.example.com.

 [Additional-Data Section]
  mail.example.com.      MX   5   mx-1.example.com.
  mail.example.com.      MX   5   mx-2.example.com.
  mx-1.example.com.      A    10.0.0.1
  mx-2.example.com.      A    10.0.0.2

[note that the MX RRs would not be provided in the Additional-Data section
if a query for ALL resulted in them being provided in the Answer section
of the response]

Any and all hosts in the mail.example.com domain are authorized relay
servers for example.com:

 [Answer Section]
  example.com.           MS   1   mail.example.com.

 [Additional-Data Section]
  <empty>

[the PTR for the current mail session should be examined, and if it
resides within the specified domain, then it is authorized]

These could also be cumulative. EG, use the IP addresses associated with
outbound.example.com PLUS the MX RRs associated with the mail.example.com
domain as the authorized relay servers for example.com:

 [Answer Section]
  example.com.           MS   0   outbound.example.com.
                         MS   3   mail.example.com.

 [Additional-Data Section]
  outbound.example.com.  A    10.0.0.3
  mail.example.com.      MX   5   mx-1.example.com.
  mail.example.com.      MX   5   mx-2.example.com.
  mx-1.example.com.      A    10.0.0.1
  mx-2.example.com.      A    10.0.0.2

The benefit of this approach is that it allows for sender-based
customization of the interpretation (hosts vs MX lists), but minimizes the
risk of overloads. The above needs more smoothing out but I think it is
workable.

Any other flags which would be useful? Any comments on this approach?

-- 
Eric A. Hall                                        http://www.ehsco.com/
Internet Core Protocols          http://www.oreilly.com/catalog/coreprot/

---

From: Alan Barrett <[email-masked]>
Date: Sun, 2 Jun 2002 19:31:24 +0200

On Sat, 01 Jun 2002, Paul Vixie wrote:
>    2.1. Domain owners who wish their mail source/return information to be
>    repudiable will enter stylized MX RR's into their DNS data, whose owner
>    name is "MAIL-FROM", whose priority is zero, and whose servername
>    registers an outbound (border) relay for the domain.  For example, to
>    tell the rest of the Internet who they should believe when they receive
>    mail claiming to be from [email-masked], the following DNS MX RR's should
>    be entered:
> 
>       $ORIGIN isc.org.
>       MAIL-FROM MX 0 rc
>                 MX 0 rc1

I think that the magic label should begin with an underscore
(e.g. "_MAIL-FROM"), for the same reasons that we use "_tcp" rather than
just "tcp" as a label for SRV records.

--apb (Alan Barrett)