Subject: Re: [Asrg] seeking comments on new RMX article

From: Scott Nelson <[email-masked]>
Date: Sun, 04 May 2003 16:11:01 -0700

At 10:49 AM 5/4/03 -0400, Alan DeKok wrote:
>Dave Crocker <[email-masked]> wrote:
>> What this therefore asserts is that the domain name in a From field is
>> always tied to a fixed set of originating MTAs.
>> 
>> The presumption is incorrect.
>
>  I agree.  But I still like RMX.
>
>  What's important for me is that RMX allows the receiving MTA to
>trivially discover that the originating domain has consented to send
>mail from that MTA.  Right now, we have *no* way of verifying the
>originators consent.
>

If the RMX matches the IP, it's a good bet the domain is not forged.
If the RMX doesn't match, all bets are off.

>> For a variety of reasons -- notably for some mobile users -- the
>> originating MTA may well be unable to know the set of valid domains
>> sending from it.  That is, some mobile users must be able to
>> spontaneously post through different MTAs.
>
>  I've heard this before, and I have no idea why it's true.
>
>  Are there NO other methods which a mobile user may use to send mail?
>SMTP is only one of many protocols used to send/receive email.
>

It's not so much that they can't as that they don't.
And they don't because it's useful to do otherwise.

>> This highlights an important requirement for evaluating proposals:  What
>> *valid* scenarios does it prevent?
>
>  Used properly, RMX doesn't prevent anything.  It simply allows the
>recipient MTA to make faster, better decisions about how to deal with
>the email.
>
>  No RMX?  Run the message through a content filter with a high false
>positive rate.  RMX?  Run the message through a content filter with a
>high false negative rate (spam is now accountable, and traceable...)
>

"used properly" aye - there's the rub.
Draft-danisch-dns-rr-smtp-01.txt mentions that receiving servers
are free to drop email that doesn't have an RMX record.
That may be true, but IMO it isn't best practice.

The questions I have are;
What percentage of the people who use it will use it improperly?
And what happens when it's used improperly?

Scott Nelson <[email-masked]>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Mike Rubel <[email-masked]>
Date: Sun, 4 May 2003 18:44:41 -0700 (PDT)

SN> If the RMX matches the IP, it's a good bet the domain is not forged.
SN> If the RMX doesn't match, all bets are off.

One more case here--if RMX is present and doesn't match, the message is 
definitely forged (or the system is misconfigured).

If the sender doesn't want to bother with RMX, he or she simply doesn't
post RMX records.

There is no legitimate situation where RMX is present and does not match
on a valid email.

AD> Used properly, RMX doesn't prevent anything.  It simply allows the
AD> recipient MTA to make faster, better decisions about how to deal with
AD> the email.

SN> "used properly" aye - there's the rub.
SN> Draft-danisch-dns-rr-smtp-01.txt mentions that receiving servers
SN> are free to drop email that doesn't have an RMX record.
SN> That may be true, but IMO it isn't best practice.

Receivers are free to do anything they like with the email; I had pictured
RMX providing information to (for example) spamassassin.

SN> The questions I have are;
SN> What percentage of the people who use it will use it improperly?
SN> And what happens when it's used improperly?

If it's used improperly, then mail gets dropped--the same thing that
happens when the recipient's mail server or DNS is configured improperly,
or if its spam filter is too aggressive.  Users complain, and the system
gets fixed.

RMX is about the least-complicated (and therefore least error-prone)  
solution to this problem that I've seen, though.  Do you know of other
solutions are less likely to be used improperly?

Mike

---

From: "Alan DeKok" <[email-masked]>
Date: Mon, 05 May 2003 10:35:09 -0400

> And what happens when it's used improperly?

  If the sender uses RMX "improperly", then the receiver sees that RMX
doesn't match the originating MTA.  The receiver can then decide to
treat the message more negatively, than messages where the RMX does
match.  So the sender gets punished for being stupid.

  If the receiver doesn't use RMX properly, then they will make bad
decisions about what's spam, and what's not.  So the receiver gets
punished (by potentially losing mail), for being stupid.

  I don't see any problem here.

  Alan DeKok.

---

From: Hadmut Danisch <[email-masked]>
Date: Mon, 5 May 2003 17:04:32 +0200

> are free to drop email that doesn't have an RMX record.

The mail shouldn't be dropped, it should be rejected in order
to give the sending MTA a chance to generate an error message.

regards
Hadmut