Subject: [Asrg] Re: draft-danisch-dns-rr-smtp-01.txt

From: Scott Nelson <[email-masked]>
Date: Sat, 26 Apr 2003 16:03:26 -0700

Some time in the past, someone wrote:
>>On Wednesday, April 16, 2003, at 04:20 PM, Hadmut Danisch wrote:
>>
>>btw, the second version of the RMX draft ist available
>>at
>
>http://www.ietf.org/internet-drafts/draft-danisch-dns-rr-smtp-01.txt
>
>Perhaps I'm missing it, but I still don't see a solution to the 
>problem of "needing more RMX records than can safely fit inside a 
>UDP response packet".
>

While I don't like the idea of trying to use IP addresses as
authentication tokens, and I have my doubts about the 
usefulness of sender authentication period (as already mentioned,
forwarding, and mailing lists break this), IF you're going 
to do it, why not do it in a less intrusive way that also 
deals with the problem of too many RMX records than can 
safely fit in a UDP response packet?

Recognize that the goal for the receiver isn't to find all the 
valid IP's for a domain, but rather just the one they are receiving
email from.  To answer the question "is IP a.b.c.d an authorized 
IP for example.com?", the receiver could check 
d.c.b.a.rmx.example.com.
This /could/ be a new record, but it's better IMO for it to be like 
the current DNSBLs and look for an A record, with the value 
returned being well defined (unlike the current DNSBLs).

If you approach it that way, then it's probably better to
carve off a long name and make rmx a lower-level designator so as
to preserve future expansion possibilities.  I.e.
lookup d.c.b.a.rmx.dns-based-query.example.com

A records (or any other already existing DNS record) are preferred
because old versions of some software will actually crash when 
encountering unknown RRs.  In particular, BIND used to do this.
(Yes, I know that everyone is /supposed/ to upgrade BIND, 
but it's unreasonable to expect that everyone will.)

This would require that anyone who wanted to take advantage of this
update their DNS servers, but it would have no impact on those who
don't.  For those that can't, and to alleviate the chicken and egg
problem, one could set up a server that also answered such queries.
For example, after checking d.c.b.a.rmx.dns-based-query.example.com
and getting no response, you could check 
d.c.b.a.rmx.dns-based-query.example.com.second-query.nh.bz or any
other server that was willing to host such a list.

Scott Nelson <[email-masked]>
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sat, 26 Apr 2003 23:49:41 -0600 (MDT)

> From: Scott Nelson <[email-masked]>

> ...
> ...

The problem with that is that Hotmail, Yahoo, and most of the rest of
the owners of the domain names that appear in SMTP Mail_From senders
in the majority of spam instruct their DNS servers to always answer
"yes, a.b.c.d authorized" for any and all IP addresses.

As far as I can tell almost all free mail providers not only
allow but encourage their users to send their mail using the
ISPs that provide connectivity.  They do this for several reasons:

  - It is cheaper for the free mail providers to let someone else
     provide the bandwidth, CPU cycles, and so forth to send mail.

  - Many free mail provider users cannot send mail through their free
     providers, because their connectivity providers block port 25.

  - Many free provider users want to use free mail boxes only as
     "drop-boxes."  They want to send mail from systems they are
     comfortable with or forced to use (e.g. by port 25 filtering),
     but receive mail elsewhere for various reasons including not
     exposing their professional affliations and reducing spam in
     their main mailboxes.

Various forms of roaming including using your laptop in airports and
varying IP addresses provided with DHCP or IPCP to dialup, DSL, and
cable modems make it impractical for free providers to know their
customers well enough to know which IP addresses each will use.  Virtuous
free providers could know their customers well enough to prevent spam
by requiring performance bonds such as credit card numbers, but even
good customers can't know what IP addresses they'll be using tomorrow.

Thus, free providers that did not teach their DNS servers to always
answer your question "Sure, that address is authorized" would have
many fewer users.

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Sun, 27 Apr 2003 05:01:27 -0700

> "yes, a.b.c.d authorized" for any and all IP addresses.

Do you really think hotmail.com aren't sick of spammers pretending
to send mail from their domain, and their domain thereby becoming
equivalent in many people's minds to spam?

--j.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 27 Apr 2003 10:18:45 -0400

> "yes, a.b.c.d authorized" for any and all IP addresses.

  Then their abuse desks should accept complaints about forged spam
from their domain.  And people getting spammed by forgeries should be
able to sue those hosts as sources of spam.

>      provide the bandwidth, CPU cycles, and so forth to send mail.

  And we're back to the idiotic idea of "it's cheaper for me to set up
my system so that it's easy for spammers to use it to attack you."

  This reminds me of a recent discussion I had with someone while
playing "Diplomacy".  He approached me, and offered a "deal": England
would give up western Europe, and let France take it over.  When I
explained that there was no upside for me (as England), he said "But
it would be good for me!"  When I reversed the situations in a
hypothetical example, he agreed that the deal was nonsense.

  No amount of dicussion would convince him that it was idiotic of him
to believe I would roll over and play dead so he could kick me.  There
was a massive conceptual gap.  Yahoo, Hotmail, etc.  appear to have
similar conceptual gaps.

  Alan DeKok.

---

From: "Mark Delany" <[email-masked]>
Date: 27 Apr 2003 14:46:15 +0000

> > From: Scott Nelson <[email-masked]>

Designated Sender stuff...

> "yes, a.b.c.d authorized" for any and all IP addresses.

I doubt it. They suffer hugely from bogus addresses in their domain
space and anything that reduces the huge bounceback plus reduces their
abuse load plus reduces the bad press they get from appearing to be a
spam haven will be seen as a good thing.

> ISPs that provide connectivity.

Not so. Especially given that most of the free providers still get a
lost of their revenue stream from having eyeballs look at their web
pages while composing and sending email.

Evidence of this is that port 25/110 access - when provided by
freemail providers - is now mostly only done so on a fee basis to
compensate for lost eyeballs (admittedly that's also an anti-abuse
strategy but it's not the only reason).

>      provide the bandwidth, CPU cycles, and so forth to send mail.

Marginally so, but unlikely to be a dominating factor. Outbound mail
from freemail providers is typically swamped by the web traffic and
inbound mail/spam. Consider that a single page view of a single email,
heavily laden with ads is what, 5-10 times bigger than the average
outbound mail?

>      providers, because their connectivity providers block port 25.

That is true and unfortunate collateral damage. I wish that RFC2476
was written with a "MUST AUTHENTICATE" and was more widely deployed so
that connectivity providers could safely leave port 587 open.

> customers well enough to know which IP addresses each will use.

That is true, but I don't think you should under-estimate the benefit
freemail providers perceived in a designated sender scheme.  I do work
for a large provider and speak to others - the bad press, the abuse
load and the bounceback loads are significant factors that add to the
appeal of developing and deploying a workable DS scheme.

Regards.

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 27 Apr 2003 10:45:55 -0600 (MDT)

> From: "Mark Delany" <[email-masked]>

> space ...

What evidence is there for that assertion?  Logic and all of the
evidence I've seen contradicts it.

> pages while composing and sending email.

People provide 10 or more times as many opportunites to be shown ads
as they check and read their mail than when they compose mail.

> strategy but it's not the only reason).

What evidence is there that abuse and still other issues such as port
25 filtering and the administrative hassles of configuring port 110
are not the only reasons for their charging for port 25/110 access?

> appeal of developing and deploying a workable DS scheme.

If you work for a large *free* provider, could you provide some
measurements in support of your claim that free providers "suffer
hugely from bogus addresses in their domain space"?  How much of the
use of free provider addresses can honestly be said to be "forged?"

Emu.st does not seem to be a large provider, free or otherwise.  That
suggests your use of emu.st instead of an address at your employer
might be an example of what many foolishly and falsely term "forgery."
Even if not, your use of emu.st is an example of the market forces
that render moot any and all proposals that would have the free
providers validate their users by DNS or other means.  We can afford
the monetary and other costs of vanity domains, but most people are
stuck with free providers.  The size of the market for the weak
anonymity provided by the free providers is too large.