Subject: [Asrg] On assertions

From: John Levine <[email-masked]>
Date: Tue, 29 Jul 2008 17:19:16 +0100 (IST)

I'm sitting here in Dublin thinking about what the ASRG should do, 
particularly the R part, and the word Assertions came to mind.

There seems to be considerable interest in making assertions about the 
mail behavior of domains.  The simplest useful assertion is probably "we 
send no mail", but we've seen at least three different variations on that, 
including SPF -all, the MX 0 . proposal, and attempts to shoehorn it into 
SSP/ADSP.

Keeping in mind that there is no inherent reason to believe any assertions 
that a domain makes about itself, nor is there any reason for a receiver 
to do anything a sender tells it to do, can we say anything interesting 
about what assertions are likely to be useful, and what are the best ways 
to communicate them?  Discuss.

R's,
John
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Tue, 29 Jul 2008 09:29:12 -0700

On Jul 29, 2008, at 9:19 AM, John Levine wrote:

> There seems to be considerable interest in making assertions about  
> the mail behavior of domains.  The simplest useful assertion is  
> probably "we send no mail", but we've seen at least three different  
> variations on that, including SPF -all, the MX 0 . proposal, and  
> attempts to shoehorn it into SSP/ADSP.
>
> Keeping in mind that there is no inherent reason to believe any  
> assertions that a domain makes about itself, nor is there any reason  
> for a receiver to do anything a sender tells it to do, can we say  
> anything interesting about what assertions are likely to be useful,  
> and what are the best ways to communicate them?  Discuss.

A self-assertion which has a positive effect on the delivery rate of  
the apparent sender is unlikely to be believed, as any crook can make  
that assertion, and many will.

A self-assertion that's neutral is likely to be believed, as there's  
no immediate advantage to the bad guys in making it.

A self-assertion which has a negative effect on the delivery rate of  
the apparent sender of mail is likely to be believed, as there's no  
real incentive for the domain owner to publish it, apart from "because  
it's true". "I send no mail" is the obvious example of that.

"I send no mail" is interesting in another way, as it (by definition)  
needs to be transmitted out of band, which makes it much more  
complicated to do than in-band assertions, while still being simple  
enough to discuss as an "obvious" example of an out-of-band assertion  
that might be useful, hence the interest in it.

Many other assertions are transmitted in-band "This is a mime  
message", "This was sent on this date", "this was sent by this  
person", "this is an html message" and so on.

Cheers,
   Steve

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 29 Jul 2008 18:56:34 +0200

John Levine wrote:

> including SPF -all, the MX 0 . proposal, and attempts to 
> shoehorn it into SSP/ADSP.

For that particular NOMAIL question I hope that the folks
who volunteered to write something about it in the 2821bis
post-2nd-last-call discussion on the SMTP list actually do
it. 

In the direction of "if you have no MX mails claiming to
be from you are not good" (plus lots of fine print about
the IPv4 A-fallback, domain literals, DSNs, etc.)  

Generally it's as Steve said, assertions helping to block
mail are interesting.  The usual way to communicate them
is DNS.  So far this needs no research, what do you have
in mind ?

 Frank

---

From: der Mouse <[email-masked]>
Date: Tue, 29 Jul 2008 13:30:27 -0400 (EDT)

> attempts to shoehorn it into SSP/ADSP.

I thought "MX 0 ." asserted not "we send no mail" but rather "we
receive no mail".  (Of course, as far as receivers are concerned,
either one may lead to rejection of mail, but that doesn't make them
the same thing.)

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML		[email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg

---

From: Steve Atkins <[email-masked]>
Date: Tue, 29 Jul 2008 10:37:47 -0700

> either one may lead to rejection of mail, but that doesn't make them

They're not the same thing. But if a domain can receive no email
then it's certainly not sending any email it cares about, as there's
no way for it to receive any bounces. So it's an assertion that the
sending domain doesn't have any problem with receivers rejecting
or discarding that mail, and the implication there is obvious.

Cheers,
   Steve

---

From: der Mouse <[email-masked]>
Date: Tue, 29 Jul 2008 13:33:49 -0400 (EDT)

> that assertion, and many will.

It's not quite so clear to me.

A self-assertion on the part of a sender which if believed would have
positive effect on mail _apparently_ from that sender, well, mostly
agreed, but see below.

A self-assertion on the part of a sender which if believed would have
positive effect on mail _actually_ from that sender seems like a
clear-cut case, but it's not quite so simple.  Such assertions are
unlikely to be accepted blindly, but they _can_ be of use in that they
inherit the claimer's reputation: a sender with a good reputation can
usefully make such claims.

> real incentive for the domain owner to publish it, apart from
> "because it's true". "I send no mail" is the obvious example of that.

I disagree that there's no incentive to apparent senders to publish
such assertions: it makes them less attractive forgery targets.  If the
entity has a good reputation in non-email respects, this may be a
substantial benefit.

> needs to be transmitted out of band,

I disagree that it _by definition_ needs to be out-of-band; it could be
sent in-band perfectly well - it's prima facie false in that case, but
that's not the same thing.  (Admittedly, this is hairsplitting.)

> person", "this is an html message" and so on.

Interesting you mention "this was sent by this person", because that's
an example of a self-assertion that can improve delivery - many
recipients use per-apparent-sender whitelists.  The major reason such
assertions aren't useless in practice, I think, is that the assertion's
effect is recipient-dependent.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: Steve Atkins <[email-masked]>
Date: Tue, 29 Jul 2008 11:01:56 -0700

> usefully make such claims.

I'm talking about simple self-assertions. Once you put a reputation
system into this then it's a completely different game (but, once  
there's
a reputation system in play then the benefits of positive self- 
assertions
are... unclear).

If you know through some other means that the actual sender is
trustworthy then there are other possibilities for a receiver to make
some use of assertions that sender makes about a particular piece
of email (as in TEOS) but I'm not sure there's much real world demand
for that.

> entity has a good reputation in non-email respects, this may be a

Yup. But there's no incentive to make a false negative self-assertion,
in any obvious case I can think of. The benefits are when it's true.

> effect is recipient-dependent.

The contents of the "From:" address, an smime signature, a dkim
signature, pgp encapsulation and a .sig file are all assertions that
"this was sent by this person".

Some are more trustworthy than others, but they're all useful to
base delivery decisions on - but only after you've tied them into
some sort of reputation system.

Cheers,
   Steve

---

From: der Mouse <[email-masked]>
Date: Tue, 29 Jul 2008 14:09:23 -0400 (EDT)

>> receive no mail".
> [I]f a domain can receive no email then it's certainly not sending
> any email it cares about, as there's no way for it to receive any
> bounces.

I'm not quite sure the implication is valid, unless you define "cares
about" in such a way as to make it a tautology.  Mail that is of
substantially greater value to the recipient than the sender does
exist, even though most anti-spam work tends to focus on mail for which
the value inequality goes the other way.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: "Frank Ellermann" <[email-masked]>
Date: Tue, 29 Jul 2008 20:58:32 +0200

"der Mouse" wrote:

> I'm not quite sure the implication is valid

IIRC 2821bis + 2822upd expect that addresses are 
usable, e.g., for NDRs and ordinary mail replies. 

A somewhat grey area with lots of RFC lawyering,
but simplified, "if it can't receive no mail it
has no business to send mail."  AFAIK the RFCs
*allow* this interpretation, and arguably it's
a bit more than only "allow".

 Frank

---

From: John Levine <[email-masked]>
Date: 29 Jul 2008 23:08:19 -0000

>I thought "MX 0 ." asserted not "we send no mail" but rather "we

That's what it means now.  The various MX 0 . proposals overload it to
mean that you don't send any mail either.

R's,
John

---

From: John Levine <[email-masked]>
Date: 29 Jul 2008 23:08:19 -0000

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Wed, 30 Jul 2008 06:57:23 -0700

On Jul 29, 2008, at 4:08 PM, John Levine wrote:

> That's what it means now.  The various MX 0 . proposals overload it  
> to mean that you don't send any mail either.

Is it fair to require all other protocols to publish a bogus MX record  
to Opt-out from SMTP?  If anything, Opt-Out and email does not have a  
good history.  It would be much more fair to require that there be an  
MX record before accepting email that references the domain.

-Doug

---

From: "Frank Ellermann" <[email-masked]>
Date: Wed, 30 Jul 2008 17:21:38 +0200

Douglas Otis wrote:
 
> Is it fair to require all other protocols to
> publish a bogus MX record to Opt-out from SMTP? 

Of course not.  Nobody here mentioned *require* -
this was just a list of some older proposals in
the general direction of "NOMAIL assertions".

Add WKS, NOMAIL-DNSBLs, and Phil's DKIM draft for
a more complete list of this NOMAIL "opt out" zoo.
  
> It would be much more fair to require that there
> be an  MX record before accepting email that
> references the domain.

You are free to do that.  Various folks supported
it on the SMTP list (for IPv6) if somebody posts
a draft.

 Frank

---

From: der Mouse <[email-masked]>
Date: Wed, 30 Jul 2008 11:22:57 -0400 (EDT)

> Is it fair to require all other protocols to publish a bogus MX
> record to Opt-out from SMTP?

...huh?  I don't see that other protocols have anything to do with
this.

> If anything, Opt-Out and email does not have a good history.  It
> would be much more fair to require that there be an MX record before
> accepting email that references the domain.

That is incompatabile with the existing spec, which means it's
incompatible with a substantial fraction of the (huge) installed base
of mailservers - ie, a great many of them depend on
fallback-to-address.

Still, if you think it's a good idea, give it a try.  It might work for
some sites.

/~\ The ASCII				der Mouse
\ / Ribbon Campaign

---

From: "David Nicol" <[email-masked]>
Date: Wed, 30 Jul 2008 14:07:19 -0500

>>> "we receive no mail".
> Is it fair [?]

I thought one indicated "we receive no mail" by establishing a valid
MX record that points to a machine with the smtp port open and a silly
little daemon that gives 552 errors in reply to all MAIL FROM commands
listening on it.  (would that be a viable commercial service?)
_______________________________________________
Asrg mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/asrg