Subject: Re: draft-dnsbl-harmful-01

From: Sam Hartman <[email-masked]>
Date: Sun, 04 Dec 2005 16:29:02 -0500

>>>>> "Daniel" == Daniel Feenberg <[email-masked]> writes:

    Daniel> Is there a proper place to discuss

    Daniel> http://www.ietf.org/internet-drafts/draft-church-dnsbl-harmful-o1.txt
    Daniel> ?

Hi.  This is by no means any sort of official response, just my own
personal opinion.

You can talk to the author of that draft and try and convince him that
the draft should become more balanced.  That may work.

The author may actually believe it is better for him to present a
consistent viewpoint and single opinion so he may not want to make it
more balanced.  In that case perhaps the best approach is for you to
write up your opinion of DNS blacklists as an internet draft.

--Sam

_______________________________________________
Ietf mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ietf

---

From: Douglas Otis <[email-masked]>
Date: Sun, 04 Dec 2005 17:16:09 -0800

> the draft should become more balanced.  That may work.

Traditional black-hole lists represent a small percentage of sources for
abusive email.  The IP addresses reported as belonging to accounts that
should not be sending email represents a substantial portion of sources
sending spam and viruses.  Much of these addresses are obtained by way
of cooperation with various providers, and may not represent a dynamic
address.

In the past, these lists may have been described as Dial-Up Lists (DUL).
These accounts may have static IP addresses, but operate under contracts
prohibiting operation of an MTA.  There may be disagreements regarding
an address included on these lists.  When the customer of an ISP
complains, they are often required to have the request forwarded on
their behalf by their provider, when in conflict with information
offered by the provider.

Often, resolution of such listings requires a different class of account
be obtained from the provider, such as business versus residential.  The
listing service will trust information offered by the provider and not
override this information based solely upon complaints by their
customers, regardless of the nature of the IP address being either
static or dynamic.

There are newer strategies being used beyond the traditional black-hole
Today, many of t listing, in addition to the DUL.  Unlike filtering,
these lists often provide the sender an error message that indicates the
list causing refusal of their message.  Without substantial reductions
in overhead afforded by black-hole lists, more exacting efforts aimed at
thwarting other types of email attacks would not be possible.

Perhaps once EHLO or signature authentication based upon the customer
becomes more widely available, name based listings would avoid some
collateral blocking that occurs when the MTA is being shared.
Authorization mechanisms will result in unfair name blocking by holding
the email-address domain owner accountable, even though they are likely
unable to monitor or respond to any abuse.  What better scheme is there?

-Doug

---

From: Daniel Feenberg <[email-masked]>
Date: Sun, 4 Dec 2005 10:26:48 -0500 (EST)

Is there a proper place to discuss

http://www.ietf.org/internet-drafts/draft-church-dnsbl-harmful-o1.txt ?

There has been some discussion of the draft in the ASRG list, but no one
their seems to be aware of the most appropriate venue for such discussion,
nor does a visit to the IETF website.

While the author does a good job of listing the negative aspects of domain
name based blacklists, he omits the advantages. A balanced discussion
would accept that for several reasons DNSBLs are the best available spam
suppression technique.

The first advantage of DNBLs I want to mention is a private benefit for
the mail transfer operator, his users, and their corespondents. 

The typical mailserver using DNSBLs for spam suppression REJECTS suspected
bad mail, while a typical content based scanner DISCARDS suspected spam,
or leaves it in a spam folder. In the case of a false positive This is a
significant advantage to the DNSBL, because the actual sender will get a
notice of refusal from the DNSBL based system, but no notice at all of the
discard from the content based system. A user or MTA operator might place
much greater weight on lost mail than rejected mail, as lost mail may be
the source of ill feeling, while rejected mail is merely an inconvenience.  

The second advantage I want to mention is the public benefit to all email
users when MTA operators administer their sites to discourage the output
of spam. In the present legal environment, the existence of DNSBLs is the
primary motivation for such efforts. Without DNSBLs, many large ISPs and
hosting companies would lose interest completely in suppressing spam
spewage from their MTAs and IP addresses. With the resulting increase is
spam messages, content analysis would become increasing difficult.

Without consideration of the advantages of the DNSBL, the author has come
to a foregone conclusion. An IETF document deprecating a superior solution
is unfortunate.

I am aware that some content based scanners are able to reject mail, and
that some MTAs using DNSBLs discard mail, but both situations are unusual,
and the former is technically difficult. In any case, placing suspected
spam in a spam folder seems like more of a way to avoid legal liability
than to improve the user experience.

I am aware that some MTA operators are frustrated by their inability to
get off certain DNSBLs, and I do not have a cost free solution. I have
referred such operators in the past to my page at 

http://www.nber.org/sys-admin/smarthost.html

which suggests that they obtain mail relay service from an operator of an 
unlisted MTA and provides some sources. 

I have done some original research on the effectiveness of DNSBLs which is
posted at

http://www.nber.org/sys-admin/dnsbl-comparison.html

however, the quantitative results are less important here than the
qualitative difference between rejected and lost mail, and the possibility
that ISPs would no longer see any advantage to policing spam originating
in there systems.

Thank you for this opportunity to comment.

Daniel Feenberg
National Bureau of Economic Research
1050 Mass Ave
Cambridge MA 02138
617-588-0343
feenberg at nber dotte org

---

From: Harald Tveit Alvestrand <[email-masked]>
Date: Mon, 05 Dec 2005 14:01:04 +0100

> nor does a visit to the IETF website.

This is an individual draft, so the most proper procedure is to ask the 
author what forum he wishes to have it discussed in.

Personally, I think the ASRG mailing list is a reasonable venue to pick.

                     Harald Alvestrand

---

From: "william(at)elan.net" <[email-masked]>
Date: Mon, 5 Dec 2005 07:23:43 -0800 (PST)

> Personally, I think the ASRG mailing list is a reasonable venue to pick.

The author of that draft already sent it to rfc-editor for publication 
(and he never before asked for comments or presented the draft on any 
anti-spam mail list as far as I know). Discussion on the draft would 
certainly be helpful, especially in light of existence of dnsbl draft 
that was worked on asrg for several years and now being prepared for 
submission as well.

-- 
William Leibzon
Elan Networks
[email-masked]