Subject: [Asrg] RMX and MUAs

From: "Daniel Erat" <[email-masked]>
Date: Tue, 6 May 2003 22:26:28 -0700

The RMX proposals that I've seen appear to be concerned solely with
forged MAIL FROM addresses (as described in RFC 821).  I believe that
most MUAs that are in widespread use only display From: headers (as
described in RFC 822), and the majority of end-users are not aware of
the existence of anything else.

If RMX use becomes widespread, spammers will likely avoid rejections
by adding RMX records for their own domains, using empty MAIL FROM
addresses, and using forged MAIL FROM addresses belonging to domains
that have not added RMX records.  I see nothing to prevent spammers
from continuing to use forged RFC 822 From: addresses, though.  In
light of this, how will an RMX implementation prevent spam or other
mail with forged (from most users' perspectives) addresses from being
just as rampant as is currently?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 7 May 2003 10:12:05 +0200

On Tue, May 06, 2003 at 10:26:28PM -0700, Daniel Erat wrote:

> from continuing to use forged RFC 822 From: addresses, though.

This is indeed an important point (which I addressed in my draft).

The empty envelope sender address is a severe problem which 
could be abused by spammers, no doubt. This is broken by design
and not easy to fix. However, these mails are limited to a certain
class of error messages. There are other ways to cope with it,
e.g. could they be required to have a reply-to header to a 
message-id of a former message recently delivered. Or need to 
have a subject of an error message. But I do agree that this 
empty sender address is a design flaw (of SMTP).

Another problem is that MUAs do display the From: address only.
This is not a severe problem, since the RMX does not require
user interaction. RMX works without needing the MUA to display
the envelope sender address.

There are two reasons why my draft didn't cover the From: address:

- The receiving MTA simply doesn't know it before receiving the
  full message body. RMX was designed to be effective in a very
  early state of message transmission, i.e. after MAIL FROM

- The semantic of the From: header line is not very clear, especially
  in context of forwarding, mailing lists and "message bouncing".

  Take this particular message you are reading right now (you
  get it twice, take the version that came from the mailing list processor)
  It comes from the ASRG mailing list, so it has an envelope sender
  address from ietf.org. That's what is used to be verified by RMX.

  But the From: header line says [email-masked], because that's
  the message's content. The sender of the message is ietf.org, and
  it says the author of the body is [email-masked]. 

  It is this subtile difference in semantic that makes it difficult
  to use the From: header line for authentication. 

  If you want to have transfer authenticity, you need to use
  the transfer address (e.g. RMX)

  If you want to have content related authenticity, you need to 
  use the body address (e.g. with PGP or S/MIME). This does provide
  a very high level of security, but it is unrealistic to believe
  that we could get this deployed world wide.

Hadmut

---

From: "Daniel Erat" <[email-masked]>
Date: Wed, 7 May 2003 07:43:10 -0700

On Wed, May 07, 2003 at 10:12:05AM +0200, Hadmut Danisch wrote:
[snip]
> This is not a severe problem, since the RMX does not require user
> interaction. RMX works without needing the MUA to display the
> envelope sender address.
> 
>   Take this particular message you are reading right now (you get it
>   twice, take the version that came from the mailing list processor)

I understand why RMX is not able to examine RFC 822 headers.  My point
was that RMX does nothing to curtail the sending of messages with
forged 822 From: addresses.  Since this is the only sender address
that most users see, and the address that replies go to (in absence of
a Reply-To: or related header), I disagree with the assertion that
this is not a severe problem.

Even if it is conceded that widespread adoption of RMX will prevent
forged envelope MAIL FROM addresses of participating domains and that
this widespread adoption is feasible, it remains controversial that
RMX will cut down on the volume of spam being received (how will
blacklisting domains be more effective than the current method of
blacklisting ranges of IP addresses?).  What's to keep spammers from
using their own RMX records or an envelope from address belonging to a
domain that hasn't implemented RMX, along with forged 822 From:
addresses, to acheive the same effect that they do currently?  In the
second case (forged envelope address from non-RMX domain), even
assuming correct WHOIS data, how can the true identity of a spammer be
found through RMX?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Hadmut Danisch <[email-masked]>
Date: Wed, 7 May 2003 18:06:31 +0200

> this is not a severe problem.

Well, RMX could be used to verify the From: address as well.
Feel free to ask your MTA to do another RMX lookup after 
receiving the message body (and before sending the reply code).
If you like it, you can do it.

My point is not, that RMX would not be able to provide that
kind of security. It could. 

My point is that this kind of security is something you certainly
do not really want to have in some cases. But if you really want,
feel free to use it for the From: address.

Hadmut

---

From: Michael Rubel <[email-masked]>
Date: Wed, 7 May 2003 15:36:56 -0700 (PDT)

> the existence of anything else.

Good point, Daniel.  I have added a note about this here:

http://www.mikerubel.org/computers/rmx_records/#notes_internalfromheader

Mike