Subject: [Asrg] Disaster looming: SPF

From: Matthew Elvey <[email-masked]>
Date: Sat, 04 Dec 2004 17:23:27 -0800

Vipul:  Here's how CSV or SPF handle the scenario you paint:
Systems that are able to keep their noses clean will have better 
reputations than other systems.
An ISP (typically) (in the case of CSV) or a .com domain (typically) (in 
the case of SPF) will be motivated by the scheme to keep its nose clean 
(the mail stream emanating from its users' systems, that is, to be precise).
If it doesn't, there will be consequences.  Its infrastructure costs 
will go up, as it has to work hard to deliver a huge mail queue that 
piles up as it tries do deliver to machines that are throttling or 
tempfailing it's delivery attempts for as long as it's reputation is 
questionable.
Make sense? You're familiar with the aspen framework?  One difference 
between CSV and SPF is that the latter doesn't do a good a job defining 
the party most able to do something about the problem.  (The SPF 
protocol allows the party to be poorly defined and hard to trace.)

On 11/27/2004 4:32 PM, Frank Ellermann sent forth electrons to convey:

> SPF is not the FUSSP, it's the next "necessary" step.

Nonsense.  SPF breaks MUCH MORE than is necessary to achive sender 
authorization and authentication.

>Defining "necessary" by the minimal modification you can get
>away with (excl. radical approaches like "delete all bounces"
>because that breaks SMTP).
>
>  
>
>>At this point, strong SPF checking breaks too much stuff
>>(especially forwarding).
>>    
>>
>
>It's not "especially forwarding"
>
True, that's not the biggest problem of SPF.  A bigger problem is the 
ISP end-user support nightmare looming around the corner: the 
reconfiguration of every power user's MUA, since SPF breaks their 
current configuration. It's not going to happen.

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Mon, 06 Dec 2004 01:49:16 +0100

Matthew Elvey wrote:

> SPF breaks MUCH MORE than is necessary to achive sender

That's not true.  SPF is simply a way to enumerate all IPs of
MTAs using HELO do.ma.in or MAIL FROM:<[email-masked]> while
talking to (one of) the MX of the receiver.  You can check it
there, or forget it, but don't try to check it behind your MX.

> A bigger problem is the ISP end-user support nightmare
> looming around the corner: the reconfiguration of every power
> user's MUA, since SPF breaks their current configuration.

How do you define "power user", direct-to-MX maybe ?  In that
case he has his own (e.g. DynDNS) domain with his own sender
policy.  Or without a sender policy but still his own domain.
(And he has an MX with a static IP, but that's another story).

> It's not going to happen.

Just watch while it's happening, worms and spammers daily forge
addresses of innocent bystanders, and everybody hit by the side
effects of these forgeries is an SPF addict within hours.  Bye.

---

From: Barry Shein <[email-masked]>
Date: Mon, 6 Dec 2004 18:57:10 -0500

SPF seems to have a net.sociology very similar to libertarianism in
that certain true-believers will argue for either tirelessly and to
the distraction of any discussion list which dares get near the topic
leaving most everyone else wondering "if it's so great why do we only
hear about it in these tiresome take-on-all-comers arguments but never
seem to see it achieve any progress per se?"

It seems to badly suffer from something that needs a term, howsabout:

	  Podiumaginary: Ideas which only exist on a podium.

		 -b

---

From: "Eric S. Raymond" <[email-masked]>
Date: Mon, 6 Dec 2004 20:22:40 -0500

> seem to see it achieve any progress per se?"

I agree there's an important parallel -- your opinions about libertarianism 
were always pretty misinformed and idiotic, too.
-- 
		<a href="http://www.catb.org/~esr/">Eric S. Raymond</a>

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 7 Dec 2004 09:34:38 +0100

On Mon, Dec 06, 2004 at 06:57:10PM -0500,
 Barry Shein <[email-masked]> wrote 
 a message of 23 lines which said:

> "if it's so great why do we only hear about it in these tiresome
> take-on-all-comers arguments but never seem to see it achieve any
> progress per se?"

What sort of progress do you want?

Active mailing lists? We have, they are even too active sometimes :-)

Working implementations. There are at least three (counting only free
software). http://spf.pobox.com/downloads.html

Domains publishing SPF: this is something that is in the hands of the
domain holders, of course. But when aol.com, hotmail.com, gnu.org,
pobox.com, amazon.com and freebsd.org use something, you can safely
say it has significant deployment.

Domains checking SPF: this is something that is in the hands of the
mail servers managers. Trackers
(http://spf.idimo.com/how_to-s/how_to_track.html) seem to indicate
that many sites already do it.

A RFC: well, this one is on the TODO list...

---

From: Barry Shein <[email-masked]>
Date: Tue, 7 Dec 2004 17:02:32 -0500

Ah, now I remember why I stay here, for the clever repartee'!

At any rate, perhaps my comment was a teensy-weensy-bit out of line in
its choice of words, but I'll stand by the sentiment.

The point being that SPF seems:

a) Mostly harmless if for no other reason than it'll never amount to
much. But I certainly don't think it's evil or anything horrible like
that, just very weak.

b) Does contain a trade-off of privacy vs security which doesn't seem
justified.

c) Similar for effort of deployment.

d) Seems to have less and less to do with spam, per se, whenever it's
explored in some detail, except inasmuch as one can broaden their
definition of spam to "any email I don't want" (e.g., viruses, joe
jobs, etc.) on the spot.

e) As such, seems to get much more attention on this list than it
deserves (my comments were tossed into the middle of another longish
thread on SPF), not that that's anything I'd particularly do anything
about EXCEPT PERHAPS COMMENT ON, which comments seems to bug the hell
out of some disproportionate to their importance, IMHO.

It was more of a "this is getting really, really boring and going
around in circles perhaps for a reason" snipe.

However, if I offended anyone or hurt any feelings who gives a shit.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*

---

From: Matthew Elvey <[email-masked]>
Date: Thu, 09 Dec 2004 01:41:55 -0800

On 12/5/2004 4:49 PM, Frank Ellermann sent forth electrons to convey:

>That's not true.  
SPF breaks (some) forwarding. 
SPF breaks configurations of users* who send from more than one address!
These were discussed here before, yet you are you denying the breakage.

CSV achives sender authorization and authentication without such breakage!

>SPF is simply a way to enumerate all IPs of
>MTAs using HELO do.ma.in or MAIL FROM:<[email-masked]>
>
The drafts claim to do a lot more than that.  (Also, SPF is marketed as 
a way to identify and discard junk email.)

>How do you define "power user", direct-to-MX maybe ?  
>
No, see comment*.

>>It's not going to happen.
Ok, it would cost comcast alone $58 million to reconfigure their 
population to use mail servers 'correctly' to avoid port 25 blocking, 
according to news articles.  How much will it cost to reconfigure the 
world's users with more than one email address to use the 'correct' 
(according to SPF) mail server for each address - if their mail software 
even supports such a configuration!?  :(

>effects of these forgeries is an SPF addict within hours.  
>
Sorry, but I'm hit by these side effects, but I'm no SPF addict. What 
big sources of backscatter are going to stop sending me spew if I start 
taking the SPF drug?  Heck, elvey.com has an SPF record with a ~all, and 
it _still_ gets tons of backscatter.

* http://www.imc.org/ietf-mxcomp/mail-archive/msg01175.html :
Are users forced to send through MTAs authorized for the domain they use 
in outgoing mail: no for CSV, yes for SPF.
Wow, that's not a lot of systems that need touching in order to continue 
to work, relatively speaking! (Around 2 orders of magnitude (10000% in 
marketspeak) greater than CSV).

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 09 Dec 2004 13:43:12 +0100

> The drafts claim to do a lot more than that.

The essence is PASS - INCONCLUSIVE - FAIL, and for a given
domain and SMTP dialogue any IP is in exactly one of these
sets.  Yes, the drafts allow to construct per-user-policies
where the LHS can play a role, and there are a lot of more
or less useful subcategries of INCONCLUSIVE like "none",
"unknown", "softfail", "temperror", and "permerror", but
the essence is PASS - INCONCLUSIVE - FAIL.

> SPF is marketed as a way to identify and discard junk email.

That's like most marketing beside the point.  I'm very unhappy
if somebody markets SPF as FUSSP, because it's not.  Getting a
PASS is easy, only a PASS in cojunction with white lists makes
sense.  The real power of SPF as stand-alone solution is FAIL.
Spammers can avoid a SPF FAIL.  That's no bug, that's the idea.

>> How do you define "power user", direct-to-MX maybe ?

If your definition of "power user" is "anybody with more than
one address", then my vintage '97 MUA has no problem with SPF:

I just write mails using From: nobody@xyzzy and collect it in
a file "outbox".  And when I'm online I send it.  My MUA then
automatically uses the MAIL FROM corresponding to the account.

Why should I say MAIL FROM:<nobody@xyzzy> when sending via
mailto.t-online.de ?  BTW, even if I'd try this stunt the MSA
would automatically patch both 2821 and 2822 From.
  
Another MSA I've used until Nov 30 was mail2.hamburg.de, it
insisted on a MAIL FROM:<f-e@hamburg>  It was impossible for
me to get it wrong (enforced submission rights, see RfC 2476).

The one relay where I have a chance to screw up supports SMTP
AUTH and then allows any MAIL FROM.  But if I select the user
profile for this relay I can again send any mail in my "outbox"
with the correct MAIL FROM:<[email-masked]>

But IMHO all this has nothing to do with a "power user", it's
obvious, you can't use your ebay password at amazon and v.v.,
even kids would understand this (after two simple tests ;-)

> elvey.com has an SPF record with a ~all

Yes, ~all (SOFTFAIL) is IMNSHO a bad idea in SPF, test -all if
you want real FAILs.  It worked for me (after about 4 months),
back from daily 1000 to zero bogus bounces / challenges / etc.

                        Bye, Frank

---

From: Devdas Bhagat <[email-masked]>
Date: Fri, 10 Dec 2004 00:25:00 +0530

> one address", then my vintage '97 MUA has no problem with SPF:

What about using multiple .forwards or equivalent? Or people using the
bounce feature in mutt?

Devdas Bhagat

---

From: Frank Ellermann <[email-masked]>
Date: Thu, 09 Dec 2004 23:42:12 +0100

Devdas Bhagat wrote:

> What about using multiple .forwards or equivalent?

Forwarding is something the receiver does.  Sender policies are
something the senders publish.  Senders don't know and don't
care what a receiver does, it's his problem.  Senders only say:

"These are the IPs you as 3rd party see in MAIL FROM me to you
 at your MX, any other mail claiming to be MAIL FROM me at your
 MX is forged, don't bother to accept it, please reject it."

Why's that so difficult to understand ?  Senders have no idea
how a receiver forwards mail behind his MX, it's none of their
business.  The receiver is free to do whatever he likes.  And
if his mail setup is broken he owns the pieces.

> Or people using the bounce feature in mutt?

Is that the stuff where I get mail claiming to be MAIL FROM me,
but in fact it's from somebody else ?  I'd report it to abuse@
for the corresponding IP, it's forged.  But actually it should
never arrive if publishers of -all policies also check SPF on
their own MX.
                Bye, Frank

---

From: Devdas Bhagat <[email-masked]>
Date: Fri, 10 Dec 2004 18:58:50 +0530

> care what a receiver does, it's his problem.  Senders only say:

Right. But .forward is still used and SPF breaks that. SRS is a hack to
try and prevent it breaking.

> if his mail setup is broken he owns the pieces.

Breaking a known working feature is not a good way to keep those
power users happy.

> never arrive if publishers of -all policies also check SPF on

No. Mutt adds a Resent-from header and keeps the original mail
information. This needs deliberate action by the sender, and is the
equivalent of a .forward (slightly loosely speaking) for that mail.

Devdas Bhagat

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 11 Dec 2004 00:01:17 +0100

On 2004-12-10 18:58:50 +0530, Devdas Bhagat wrote:
> Right. But .forward is still used and SPF breaks that.

True. And that means that as a receiver you can only use SPF to reject
mail if you know that the mail did not run through a legitimate
.forward.

For my 1-person-setup at home that's pretty simple. I know where I have
.forwards pointing to which address, so I can either whitelist these
addresses or the servers with the .forwards.

For an ISP it means they have to allow users to maintain their own
whitelists and they have to offer support for those users. I am not
prepared to do that at my work place. I expect there to be way too many
support calls for the little spam/phishing/forgeries this will stop.

> information.

Mutt also generates a new envelope MAIL FROM with the same content as
the Resent-From header, so it isn't broken by SPF.

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Frank Ellermann <[email-masked]>
Date: Sat, 11 Dec 2004 02:06:59 +0100

Devdas Bhagat wrote:

> But .forward is still used and SPF breaks that.

SPF fixes it.  551 is an error.  251 was an exception, a
courtesy, a hack, it worked with reverse source routes,
sometimes.  It was never meant to be used generally and
forever, otherwise there would be no 251 / 551.

It hurts millions of innocent bystanders with tera bytes
of forgeries and the resulting bounces / challenges / out
of office and whatever else mails.

Today .forward is the worst loophole in SMTP, worse than
open relays.  And SPF closes it.  It's a feature, no bug.

                      Bye, Frank