Subject: Re: [pkix] Email address matching rules, this is a swamp you do not want to visit

From: "John R Levine" <[email-masked]>
Date: 6 Mar 2016 23:28:18 +0100

> On the other hand, I would note that in this area perfect may be the
> enemy of good and if we can make things better for some or perhaps many
> with little or no cost, then why not do so?

Just catching up here, but:

It is not an accident or an oversight that RFCs 5321 and 5322 and its 
predecessors do not provide any advice for canonicalizing e-mail 
addresses.  The number of ways MTAs match addresses is only slightly less 
than the number of MTAs, and it changes way more often than casual 
observers think.  As a concrete example, until Gmail came along, MTAs that 
ignored dots in the local part of the address were exotic and peculiar. 
Now only a few years later, a lot of people wrongly believe that everyone 
does it and always have.

Case folding is a red herring -- it is indeed true that pretty much every 
MTA that handles ASCII addresses treats upper and lower case the same, but 
that is about 0.1% of the address matching problem, 0.01% if you add in 
EAI with UTF-8 addresses.

If you want to work on this, you need to get at least one of John Klensin, 
Dave Crocker, Pete Resnick, and Ned Freed as co-authors, preferably all of 
them, because they are the people who wrote the RFCs that say how 
addresses are handled, and they're the people who know about the cases 
that haven't occurred to people not immersed in the mail world but will 
bite you when you try to do it.

See https://tools.ietf.org/html/draft-bhjl-x509-srv-00 for a recent draft 
we wrote to do per-mailbox key lookups in a way that matches real world 
address semantics.

Regards,
John Levine, [email-masked], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail.