Subject: Re: [Asrg] 6. Proposals

From: Philip Miller <[email-masked]>
Date: Thu, 13 Nov 2003 18:23:14 -0500

Denny Figuerres wrote:
> Excuse me if I may have missed this some where.....
> 
> Perhaps one part of the solution will be to recommend some (I think) small
> changes to how companies send out email to customers. The common practice of
> hiring a third party to send out such emails as newletters airline
> confirmations and so forth are done now in a way the can make it difficult
> to classify them as HAM not spam for a few reasons:
> 
> 1) The "From" and the sending MTA's DNS often do not mtach.
> 2) the DNS / IP of the sender may be included in a DNS RBL as a SPAM DOMAIN
> 3) attempting to check the [email-masked] fails as it does not exist or the
> test is done at the bulk senders domain which does not match.
> 
> So could the company that is "sending" the email and the "bulk delivery
> provider" fix-up the dns records and the sending mta "HELO" to match the
> "From [email-masked]" to make whitlisting simpler and tracking back via
> headers a bit sane-er ?
> 
> If this would not cause major issues it would clear up a lot of issues with
> bulk delivery of legit emails.
> 
> Just my idea based on some real world problems .....

This is something that the current LMAP proposal could accomplish,
rather eaasily. The domain owner would simply need to add the IP
addresses of the contracted company's MTAs to their allowed list, and it
would authenticate perfectly.

--
Philip Miller

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Walter Dnes <[email-masked]>
Date: Fri, 14 Nov 2003 01:46:32 -0500

On Thu, Nov 13, 2003 at 10:35:44AM -0500, Denny Figuerres wrote
> Perhaps one part of the solution will be to recommend some (I think)
> small changes to how companies send out email to customers. The common
> practice of hiring a third party to send out such emails as newletters
> airline confirmations and so forth are done now in a way the can
> make it difficult to classify them as HAM not spam for a few reasons:

  The problem associated with 100 companies sharing one outbound MTA is
very similar to the problem associated with 100 men sharing one
girlfriend.  All it takes is for one man to get infected, and they all
suffer.

> 3) attempting to check the [email-masked] fails as it does not exist
> or the test is done at the bulk senders domain which does not match.
> 
> So could the company that is "sending" the email and the "bulk
> delivery provider" fix-up the dns records and the sending mta "HELO"
> to match the "From [email-masked]" to make whitlisting simpler and
> tracking back via headers a bit sane-er ?
> 
> If this would not cause major issues it would clear up a lot of
> issues with bulk delivery of legit emails.
> 

  There are two competing forces at work here.  If email sent out by the
bulk-mailer is sufficiently differentiated to enable SMTP-stage
filtering, they "good-guys'" mailing lists are more likely to get
through.  If the differentiation isn't done, and a bulk-mailer like
Topica gets "Amber Alert" as a customer, they have one helluva human
shield to help get their unconfirmed lists through.  And on a cynical
note, if a company bulk-emails to some dirty lists and some clean lists,
do you really trust their alleged "clean lists" ?

  Notwithstanding that, let's assume we accept that scenario.  So we
have a company example.com that outsources a mailing list to
cyberpromo4u.biz.  cyberpromo4u.biz has a sending MTA by the name of
mta.cyberpromo4u.biz.  How about if example.com points a CNAME
bad.example.com at mta.cyberpromo4u.biz ?  The envelope sender could be
set to [email-masked].  The receiving MTA could check the IP
address for bad.example.com, and it would be the IP address of
mta.cyberpromo4u.biz, which is doing the actual emailing.  Because
example.com is assumed to control their DNS, one can reasonably assume
that example.com has authorized mta.cyberpromo4u.biz to send email on
their behalf.

  The authorization is granted in the form of a DNS entry controlled by
example.com.  It can be revoked by changing or deleting that CNAME
record.

-- 
Walter Dnes <[email-masked]>
Email users are divided into two classes;
1) Those who have effective spam-blocking
2) Those who wish they did