Subject: Trouble Interpreting RFC 2142

From: "Sabahattin Gucukoglu" <[email-masked]>
Date: Thu, 02 Oct 2003 02:08:22 +0100

Hi all,

I'm sure this has been raised before, and have done my fair share of 
searching - I think - on the matter.  Trouble is, I can't seem to 
interpret RFC 2142 properly and reach a firm conclusion.  I've seen 
variations on the interpretation of Suggestion Vs Compulsion for a while 
now, and no apparent clarification.  Perhaps the author's view would be 
particularly helpful.  The availability of the "Abuse" mailbox is the 
subject of exceptional debate.

Part of the abstract runs thus:

"Additional mailbox names and aliases are not prohibited, but 
organizations which support email exchanges with the Internet are 
encouraged to support AT LEAST each mailbox name for  
which the associated function exists within the organization."

Great.  So, while I'm not prevented from inventing fab new mailboxes for 
the same or even more services, business roles, etc., I'm at least 
tentatively asked to support the listed mailboxes for services I run, with 
the implicitly understood exception that all services for which mailboxes 
are mandated in their respective standards must be available regardless.  
Right?

Then, part of the Rationale says:

"However, if a given service is offerred, then the associated mailbox 
name(es) must be supported, resulting in delivery to a recipient 
appropriate for the referenced service or   
role."

Okay, I'm confused at this point.  I must support at least the addresses 
for services running at my domain, in contradiction to the mere 
encouragement we were getting earlier.  This statement alone is not a 
suggestion, as seems to be commonly believed (see policy at http://www.rfc-
ignorant.org/ 's Abuse list, for instance), and while no mention is made 
of a definition for "Must" or any further RFC in which the definition may 
be sought (and for which probable reason the word is therefore not in 
capital letters in the text of the RFC, as is often found in RFCs making 
such references), there seems to be a strong assumption that this 
resembles, quite understandably, a compulsion to support the minimal set 
of mailboxes, regardless (again, understood implicitly) of the definition 
of the protocol by its respective standard.

So, please, can someone help me figure this out?  To me, this is very, 
very shaky, and I wouldn't be willing to take sides without a better grasp 
on the situation and knowledge of the author's intentions in both pieces 
of the text.  Perhaps an updating RFC might help the situation, especially 
in light of today's mail usage and needs (for example, heavily of the 
aforementioned "Abuse" mailbox)?  Is some of my own understanding 
incorrect with regards to RFC precedence?

Cheers,
Sabahattin

- -- 

Thought for the day:
    Communist (n): one who has given up all hope
    of becoming a Capitalist.

Latest PGP Public key?  Click:
<mailto:[email-masked]>
and send that message as is.

Sabahattin Gucukoglu
Phone: +44 (0)20 7,502-1615
Mobile: +44 (0)7986 053399
http://www.sabahattin-gucukoglu.com/
E-mail or MSN Messenger: <[email-masked]>

---

From: [email-masked]
Date: Wed, 01 Oct 2003 22:06:38 -0400

> are mandated in their respective standards must be available regardless.  

Right.  You need Postmaster, and then section 3 says that you should have
INFO, MARKETING, SALES, and SUPPORT if appropriate.  Somehow, I
don't see my domain not having a SALES mailbox as being a grave offense. ;)

> encouragement we were getting earlier.

You need the appropriate ones from section 3.  Then you need to have
ABUSE, NOC, and SECURITY from section 4.  Then for each service
in 5, you need the mailbox *if* you run that service.  You need
Postmaster.  If you do your own DNS, you need Hostmaster.
If you have a webserver, you need Webmaster, and so on.  If you
don't have an FTP server, you don't need an FTP mailbox.

I read it as saying "We suggest you have aliases from section 3 for
appropriate business units, and the service-oriented ones from section
5 are mandatory if you run that service".  So if you have a sales
division, a mailbox called 'sales' is suggested, but if you have a
webserver, you *have* to have a 'webmaster' mailbox.

---

From: Vernon Schryver <[email-masked]>
Date: Wed, 1 Oct 2003 21:29:11 -0600 (MDT)

> From: [email-masked]

> ...

I notice that you don't say you "MUST" have a webmaster mailbox,
which is good for more than one reason.  One is that "MUST" appears
only once in section 6 concern mailing lists.  Another is that today
[email-masked] essentially never receives anything but spam.

Contrary to some who advocate rejecting mail from sites that don't do
what they call complying with RFC 2142, I read it as saying:

  If you're going to offer these services, then you probably want
  to receive comments about them.  If you do want to receive
  comments, then you'd better use these mailboxes, because that's
  where people will send their important notes about your services
  as well as offers about mortgage loans and other vital issues.

The purpose of every RFC is to improve interoperability.  The familiar
claims that not having an abuse mailbox justifies breaking SMTP
compatibility purely on grounds of Violation of Standards (Horrors!)
make sense only to people who don't read or care about those standards.
The First RFC Standard is "Be Conservative in what you send and generous
in what you accept," which implies that breaking compatibility on
legalistic grounds is always worse.

It makes sense to reject mail because of an observed a correlation
between spam and odd IP addresses, domains without about abuse
mailboxes, or anything else.  Security trumps interoperability.
If you press supporters of rfc-ignorant.org, they'll claim something
like that as justification.  However rfc-ignorant.org also lists
spamhaus.org.  Mr. Balling admits there has never been and never
will be spam from spamhaus.org and falls back on something incoherent
about a violation of RFC 2142.  Because of its name and because of
expressions of displeasure from spammers about the SBL, spamhaus.org
gets far too much junk at the standard mailboxes to do other than
have auto-responders that describe real contact methods.

You should do whatever you think is right while ignoring the sidewalk
superintendents, poseurs, would be famous spam fighters, kooks, trolls,
spammers, and other parasites.

Vernon Schryver    [email-masked]

---

From: Dave Crocker <[email-masked]>
Date: Wed, 1 Oct 2003 21:12:46 -0700

Sabahattin,

SG> Part of the abstract runs thus:
...
SG> encouraged to support AT LEAST each mailbox name for
...
SG> Then, part of the Rationale says:
SG> "However, if a given service is offerred, then the associated mailbox
SG> name(es) must be supported, resulting in delivery to a recipient 
SG> appropriate for the referenced service or   
SG> role."

SG> Okay, I'm confused at this point.  I must support at least the addresses 
SG> for services running at my domain, in contradiction to the mere 
SG> encouragement we were getting earlier.

Abstracts are not usually taken to be normative.  Certainly, this one is not
normative.

The Rationale and Scope section is intended to be a normative specification
for the generic aspects of the document.  That is, it says how the document
should be applied.

Like any standards document, the degree of actual force it carries is only as
strong as the community decides to impart to it.

d/
--
 Dave Crocker <dcrocker-at-brandenburg-dot-com>
 Brandenburg InternetWorking <www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>