Subject: Fwd: [DNSOP] Re: I-D ACTION:draft-ietf-dnsop-reverse-mapping-considerations-02.txt

From: Ted Lemon <[email-masked]>
Date: Wed, 21 Mar 2007 08:02:21 +0100

On Mar 20, 2007, at 8:05 PM, Evan Hunt wrote:
> But spam fighters are a real constituency,
> who (so I'm told) get real and useful information from reverse DNS,  
> and
> they don't seem to be very well-represented here.

In the original message you were responding to, I believe I said that  
noticing that someone can't update their reverse tree is arguably  
useful for spam scoring.   So perhaps the reason that you aren't  
seeing more discussion on the part of spam assassins here is not that  
they aren't represented in the working group, but rather that nothing  
controversial was said.   :')

Personally, I feel that spam scoring is a better example to use in  
the draft than, say, the ssh example I gave in my earlier email  
message.  But neither can be claimed to be a *requirement* - it's  
just (1) the case for spam scoring is better, and (2) someone who's  
considering not populating the reverse tree probably ought to think  
about the spam scoring case since, apparently, it is being used (if  
that is true).

_______________________________________________
DNSOP mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dnsop

---

From: Ted Lemon <[email-masked]>
Date: Wed, 21 Mar 2007 08:02:21 +0100

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Mar 2007 18:39:59 -0400 (EDT)

On Wed, 21 Mar 2007, Ted Lemon wrote:

> > But spam fighters are a real constituency, who (so I'm told) get
> > real and useful information from reverse DNS, and they don't seem to
> > be very well-represented here.

Spam fighters are very well represented here. However, one doesn't
actually get useful information from reverse DNS for spam-scoring; The
difference is, here (as opposed to say, spam-l), they have to
scientifically show such views are reasonable and responsible, and they
have a big problem doing either. See www.iadl.org for more information
on general 'reasonable and responsible' issues. See my alternate draft
at
http://www.av8.net/IETF-watch/Drafts/draft-anderson-reverse-dns-status-00.txt
for a report on what is actually known to be true about reverse DNS.

Real anti-spam groups at large ISPs don't use reverse DNS for spam
filtering.  There have been attempts to do so in the past, but those
ended in (sometimes well-publicized) disasters.

Recently, I have been studying law and evidence. I've found a better way
to explain this.  As Judge Young explained in a lecture on evidence,
there are three questions for experts:

Do you have an opinion on this case to a reasonable certainty?
What is that opinion?
What are the bases for that opinion?

We then question:
1) is it junk science?
2) is this a junk scientist?
3) is this junk opinion?

Spam-scoring on reverse DNS is junk science. There is no scientific data
showing a relationship between spam and reverse DNS maintenance.  
Second, society doesn't deal with the persons making such claims as
experts (at least not anymore--they've been discredited), and so those
making such claims aren't credible scientists.  Finally, there is no
scientific basis for the opinion that using reverse DNS for spam-scoring
is useful.  Science can't say that such tests are useful.

> controversial was said.   :')

Assuming an 'apparent inability to update reverse tree' is a false
assumption: The fact that the reverse tree doesn't match something the
remote site thinks should be there, doesn't mean that the IP address
user is unable to update the reverse.

Several other cases are possible:

-- The IP user may have a useful scheme that doesn't "match". This may
be the case if the site is multi-homed and cannot be made to "match". Or
there may be some other scheme used.

-- It may be the IP user could update the reverse, but has made a
financial decision not to do so.

-- It may be the case that the ISP chooses not to provide reverse, or
provides a reverse that doesn't "match".

-- Reverse may be autogenerated.

-- "matching" forward entries may be autogenerated.

Further, the definition of what is useful to the IP user doesn't have to
be "useful" to the remote site for spam-filtering.

So reverse DNS entries provide no information on which a spam-score can
be based.  This is why using reverse DNS for spam-scoring has been a
disaster everytime it has been tried. [the proponents who say it works
don't use it on a large scale, and don't care if a great deal non-spam,
legitimate email is lost] 

One might as well spam-score on the phase of the moon;  it has the same
degree of relevance and information. Indeed, the phase of the moon is
probably better then reverse DNS for spam-scoring because human behavior
seems to vary a little bit with the phase of the moon, while reverse DNS
maintenance has no relationship to spam whatsoever.

		--Dean

-- 
Av8 Internet   Prepared to pay a premium for better service?
www.av8.net         faster, more reliable, better service
617 344 9000

---

From: Dean Anderson <[email-masked]>
Date: Fri, 23 Mar 2007 18:39:59 -0400 (EDT)

We then question:
1) is it junk science?

		--Dean

---

From: Robert Story <[email-masked]>
Date: Mon, 26 Mar 2007 10:33:53 -0400

On Fri, 23 Mar 2007 18:39:59 -0400 (EDT) Dean wrote:
DA> Real anti-spam groups at large ISPs don't use reverse DNS for spam
DA> filtering.  There have been attempts to do so in the past, but those
DA> ended in (sometimes well-publicized) disasters.

This is patently and provably false. AOL clearly states that "AOL's mail
servers will reject connections from any IP address that does not have
reverse DNS (a PTR record)." and "AOL's mail servers will not accept
connections from systems that use dynamically assigned or residential
IP addresses." [1]  (I don't know how they are determining 'dynamically
assigned or residential IP addresses', so that may or may not be via
reverse DNS.)

SpamHaus is a rather well know spam-fighting organization, and they
clearly state that having reverse DNS is 'highly desirable.' [2]

DA> Assuming an 'apparent inability to update reverse tree' is a false
DA> assumption:

But you can't dictate other peoples assumptions. Assumptions are often
based on ones personal experiences, and it's perfectly reasonable for
different people to make different assumptions. 

DA> The fact that the reverse tree doesn't match something the
DA> remote site thinks should be there, doesn't mean that the IP address
DA> user is unable to update the reverse.

Nobody is saying that that is the case. What the spam-fighters are
saying is "based on my own experiences, more often than not a system
(without reverse DNS|with a reverse DNS record matching a certain
pattern) is not a valid source of mail." In some cases, they may be
wrong. But its their decision to make.

DA> Further, the definition of what is useful to the IP user doesn't have to
DA> be "useful" to the remote site for spam-filtering.

Indeed. Neither side can force the other side to do what they want. But
a mail admin is completely within their rights to say "if you can't
bother to provide reverse DNS, I won't accept your mail." This is no
different that a restaurant with a "No shirt, no shoes, no service"
policy.

DA> So reverse DNS entries provide no information on which a spam-score can
DA> be based.  This is why using reverse DNS for spam-scoring has been a
DA> disaster everytime it has been tried. [the proponents who say it works
DA> don't use it on a large scale, and don't care if a great deal non-spam,
DA> legitimate email is lost] 

I again refer you to [1], which is certainly a large scale mail system.

You appear to want this draft to represent a perfect utopian world,
where the authors and other proponents of the draft want to represent
the real world. In the real world, lack of reverse DNS can have
negative consequences. This is explained in the draft so that the
reader can make an informed decision about whether or not to provide
reverse DNS.

[1] http://www.postmaster.aol.com/guidelines/standards.html
[2]
http://www.spamhaus.org/faq/answers.lasso?section=ISP%20Spam%20Issues#128

-- 
Robert Story
SPARTA

---

From: Robert Story <[email-masked]>
Date: Mon, 26 Mar 2007 10:33:53 -0400

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 26 Mar 2007 12:12:33 -0400

Dear colleagues,

Dean has already made clear, in a previous exchange on this list, that
he does not think draft-ietf-dnsop-reverse-mapping-considerations in
any revision, past or future, can be made to address his concerns; my
understanding is that this is why he has offered an alternative draft
to be regarded as "completely alternate text".  Therefore, I will not
address the arguments about spam scoring in this thread.  But I do
want to address something else that has come up:

On Mon, Mar 26, 2007 at 10:33:53AM -0400, Robert Story wrote:

> the real world. 

This draft is currently a working group draft, and therefore the
author of the draft is the _working group_.  Daniel and I are merely
editors, and are earnest in our efforts to make the draft say what the
broad consensus in the working group is.  This is the reason why, if
you are participating in the WG and have comments about the draft as
it stands, you should send your comments either to the list or, if you
feel more comfortable with it, directly to me.  (I have a strong
preference for the "to the list" option, but I understand that not
everyone will feel comfortable sending comments publicly, especially
in the case of a draft that appears to be contentious.)

In light of several comments that we have received, both here on the
list (thank you!) and privately, especially at the recent Prague
meeting, we will attempt to revise the draft again.  That said,
comments on the current version are very much solicited, because your
editors would very much like to reduce the number of re-drafts
necessary.  More comments == larger basis on which to make judgements.

Thanks!

A

-- 
Andrew Sullivan                         204-4141 Yonge Street
Afilias Canada                        Toronto, Ontario Canada
<[email-masked]>                              M2P 2A8
jabber: [email-masked]                 +1 416 646 3304 x4110

---

From: Andrew Sullivan <[email-masked]>
Date: Mon, 26 Mar 2007 12:12:33 -0400

Dear colleagues,

Thanks!

A

---

From: Douglas Otis <[email-masked]>
Date: Mon, 26 Mar 2007 10:32:15 -0700

On Mar 26, 2007, at 7:33 AM, Robert Story wrote:

> This is patently and provably false. AOL clearly states that "AOL's  
> mail servers will reject connections from any IP address that does  
> not have reverse DNS (a PTR record)." and "AOL's mail servers will  
> not accept connections from systems that use dynamically assigned  
> or residential IP addresses." [1]  (I don't know how they are  
> determining 'dynamically assigned or residential IP addresses', so  
> that may or may not be via reverse DNS.)

While having a valid PTR record in the reverse address space might be  
used as one criteria for email acceptance, a test for the PTR record  
might be that it resolves to some IP address.  However, this IP  
address will not necessarily relate to the SMTP client.  A bad actor  
on a compromised a system can also easily assert a host-name matching  
that of a PTR record.

Determination of acceptable IP address space is done with the aid of  
third-party lists often determined directly from network providers.   
When the network provider does not cooperate, there might be clues  
uncovered by the reverse PTR records.  However this information is  
not reliable as it is often poorly maintained or fails to include all  
possible host-names.

> clearly state that having reverse DNS is 'highly desirable.' [2]

Forward and reverse DNS zones being properly configured helps in many  
ways.  Often prior to block-listing, an attempt is made to contact  
network providers based upon BGP information.  Reverse zones help  
confirm relationships discovered in this manner.

The seventh paragraph in section 3.1 perhaps slightly overstates  
"matching" reliance placed upon the reverse DNS zone information or  
expectations of consistent conventions.  Nevertheless, this  
information is often gleaned for rating clues.  Clearly finding a  
match improves the likelihood of message acceptance.  The reverse DNS  
space might be seen as a way for network providers to constrain the  
use of their IP address space.  However, conventions for such reverse  
zone control are lacking.  It also seems adoption of IPv6 may further  
frustrate reverse zone reliance and establishing consistent conventions.

One might expect forward based authorizations in conjunction with  
cryptographic identification will approximate current abuse control  
strategies.  At this point, it is not clear whether such  
authorization will be placed within DNS or perhaps found within  
something like OpenID structures.

-Doug

---

From: Douglas Otis <[email-masked]>
Date: Mon, 26 Mar 2007 10:32:15 -0700

-Doug

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 14:48:38 -0400 (EDT)

On Mon, 26 Mar 2007, Robert Story wrote:

> reverse DNS (a PTR record)." 

They may claim this, but it isn't true.

> clearly state that having reverse DNS is 'highly desirable.' [2]

They have been associated with other lame ideas.

> different people to make different assumptions. 

Sorry. Wrong.  Its not 'perfectly reasonable' to make false assumptions.

> Nobody is saying that that is the case. 

Ted said that.

> What the spam-fighters are saying is "based on my own experiences,
> more often than not a system (without reverse DNS|with a reverse DNS
> record matching a certain pattern) is not a valid source of mail." In
> some cases, they may be wrong. But its their decision to make.

Its their decision to make in a free society. They are free to be 
unreasonable (some constraints--can't violate laws, etc). However, it is 
quite another thing to describe unreasonable assumptions as being 
scientificially honest and reasonable.

> bother to provide reverse DNS, I won't accept your mail." 

They may be within their rights. They may not be within their rights. 
Laws control the situation when the admin works for an ISP.  Laws also 
control the situation where the admin participates in a unlawful group 
boycott.

But assuming are within their rights to be unreasonable, then they can
be unreasonable. They just can't tell others that they are
'scientifically reasonable'.

> This is no different that a restaurant with a "No shirt, no shoes, no
> service" policy.

Sorry. Wrong.  Laws apply to ISPs serving the public who have a contract 
with their customers.  However, public health policy requires "no shirt, 
no shoes, no service". That policy has a scientific basis.

The arbitrary, capricious, and unreasonable 'no reverse dns' policy has
no scientific basis.

> I again refer you to [1], which is certainly a large scale mail system.

Except that they don't practice that policy.

And there is still no reasonable scientific basis for such a policy.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 14:48:38 -0400 (EDT)

Ted said that.

		--Dean

---

From: Joe Abley <[email-masked]>
Date: Mon, 26 Mar 2007 14:56:37 -0400

> Sorry. Wrong.  Its not 'perfectly reasonable' to make false  

It's not at all reasonable to assume that when the assumptions of  
others don't match your own, they are necessarily false.

Joe

---

From: Joe Abley <[email-masked]>
Date: Mon, 26 Mar 2007 14:56:37 -0400

Joe

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 15:35:01 -0400 (EDT)

BTW, one technical point about AOL:

AOL is not an ISP; AOL is an online content provider. AOL/Compuserve
predates the internet. Internet email is a free option that AOL doesn't
have to provide. AOL can drop internet access without violating their
user contract, which is for AOL proprietary online content. This is not
true of Internet Service Providers. By contrast with online provider
like AOL, ISPs sell access to Internet content including Internet email.  
An ISP that disconnected from the internet would violate its customer
agreements.

I think there was an interesting related case with root DNS servers,
actually. If I recall, ISPs cannot route root DNS server IPs to their
own alternate root servers, since that interferes with Internet access.  
If anyone knows the reference to this case, I'd appreciate it.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 15:35:01 -0400 (EDT)

--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 17:30:07 -0400 (EDT)

I didn't _assume_ their assumptions were false. I showed the reasons why
their assumptions were false.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Mon, 26 Mar 2007 17:30:07 -0400 (EDT)

--Dean

---

From: Mark Andrews <[email-masked]>
Date: Tue, 27 Mar 2007 09:46:20 +1000

> AOL is not an ISP;

	It really does not matter what the genesis of AOL was they are a
	ISP today.  Also AOL started in 1985.  The Internet pre-dates AOL.

	Fast Facts as of November, 2006

    * AOL is the leading Internet service provider (ISP) in the U.S.
    * AOL operates the No. 2 domestic Web network in monthly unique visitors with 112 million.
    * AOL owns and operates the No. 3 online advertising network in the world
    * The AOL Network of Web properties generates nearly 52 billion quarterly page views.
    * AOL operates the No. 1 instant-messaging network in the U.S.
    * Over 2 billion instant messages are sent across AOL's messaging networks (AIM and ICQ) each day.
    * AOL blocks approximately 1.5 billion spam e-mails daily.
    * About 200 million unique users visit AOL's global Web network, ranking it fourth in the world in overall visitors.

	http://www.corp.aol.com/whoweare/facts.shtml
 
-- 
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742                 INTERNET: [email-masked]

---

From: Mark Andrews <[email-masked]>
Date: Tue, 27 Mar 2007 09:46:20 +1000