Subject: RE: DEPLOY: not at the University of Cambridge

From: "Sauer, Damon" <[email-masked]>
Date: Fri, 10 Sep 2004 09:04:22 -0500

<snip>
> 
> On Thu, 9 Sep 2004, Hallam-Baker, Phillip wrote:
> >
> > Looks to me as if you can still deploy an SPF record that 
> says that A, 
> > B & C are authentic university of Cambridge mail servers. 
> What you are 
> > saying you cannot do is to add a final -all to exclude the 
> universe of 
> > all other mail servers.
> 
> That's pretty worthless. What we need is a method of 
> identifying forgeries, not a method of identifying legitimate email.
> 
<snip>

The glass is half full. 

1) When SPF is deployed and used the line between forgeries and
legitimate will be much sharper.
2) In the corporate world, I am actually going to be able to deploy SPF
based on the argument that my MAIL FROM: will not be able to be forged.
3) Which in turn makes all MY email legitimate. This means if anyone
sends with my domain from a source outside of my defined range, you can
identify as a forgery. (I am going to start talking in circles, so I am
going to stop here)

> -- 
> f.a.n.finch  <[email-masked]>  http://dotat.at/
> ROCKALL: EAST 4 OR 5 BECOMING CYCLONIC, THEN NORTHWEST 5 TO 
> 7, PERHAPS GALE 8 LATER. RAIN LATER. MODERATE OR GOOD.
> 
> 

Regards,
Damon Sauer

*****
The information transmitted is intended only for the person or entity to which it is addressed and may contain confidential, proprietary, and/or privileged material.  Any review, retransmission, dissemination or other use of, or taking of any action in reliance upon, this information by persons or entities other than the intended recipient is prohibited.  If you received this in error, please contact the sender and delete the material from all computers. 113

---

From: David Woodhouse <[email-masked]>
Date: Fri, 10 Sep 2004 16:19:54 +0100

On Fri, 2004-09-10 at 09:04 -0500, Sauer, Damon wrote:
> identify as a forgery.

The point is that you _cannot_ reliably identify it as a forgery unless
you're willing to redefine your meaning of 'forgery' for the purpose; in
particular you'd have to redefine your meaning of 'forgery' to include a
lot of mail which a lot of people consider perfectly valid and normal.

Consider the case where you send mail a user at one of my virtual
domains, and my mail hosts forward it on to the final recipient. Some
definitions of 'forgery' may include the mail which my mail host sends
on... but my definition does not.

We know how slow the world is to upgrade even when the upgrade is useful
and well-designed, like ESMTP and TLS. For things like SRS or the
Resent-* header abuse, I'd predict that the take-up will be a _lot_
slower. If it were just an addition to a Received: header perhaps it
would be quicker to catch on though. That could be enabled by default in
MTAs. 

-- 
dwmw2

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 10 Sep 2004 14:13:29 -0400

> on... but my definition does not.

  Your definition is irrelevant.

  What matters is the definitions published by the owners of the
domains used in SMTP fields, and the application of those definitions
by the recipient MTA.

  The whole purpose of MARID is to define how those definitions are
published and interpreted, so that their application can be automated.
Phrased another way, my MTA doesn't read this list, so it doesn't know
what your definition of forgery is, and it therefore cannot apply it
to incoming messages.

  Alan DeKok.

---

From: Tony Finch <[email-masked]>
Date: Fri, 10 Sep 2004 19:33:32 +0100

On Fri, 10 Sep 2004, Alan DeKok wrote:
>
> What matters is the definitions published by the owners of the domains
> used in SMTP fields, and the application of those definitions by the
> recipient MTA. The whole purpose of MARID is to define how those
> definitions are published and interpreted, so that their application can
> be automated.

Unfortunately MARID encourages sites to define bogus policies, because
they can only describe the first part of a message's journey (up to the
border of the originating organization), and it is very difficult for a
recipient site to implement checks that accommodate all the possibilities
in the rest of the message's journey.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
COLWYN BAY TO THE MULL OF GALLOWAY INCLUDING THE ISLE OF MAN: SOUTH 3 OR 4,
VEERING SOUTHWEST TONIGHT AND INCREASING 5 OR 6, AND LOCALLY 7 AROUND THE
ISLES OF MAN, VEERING WEST 5 OR 6 LATER TOMORROW. SHOWERS. MODERATE OR GOOD.
SLIGHT, BECOMING MODERATE, LOCALLY ROUGH LATER TONIGHT AND TOMORROW.