Subject: Re: [Asrg] Please critique my anti-spam system

From: "Michael Kaplan" <[email-masked]>
Date: Sat, 08 Jan 2005 13:23:39 -0500

> > > > No innocent user will ever get an erroneous bounce if a few of the
> > > > large consumer ISP adopt the system;
> > > > I must admit I find this statement utterly incomprehensible - or more
> > > precisely, I find the idea that anyone of your obvious intelligence
> > > could believe it utterly incomprehensible.  How will - how *could* - "a
> > > few of the large consumer ISPs" adopting your system, or any other,
> > > prevent a small site handling its own mail in, say, San Jose, from
> > > sending an erroneous bounce to a user at a small site handling its own
> > > mail in, say, Ottawa?
> >
> > I was unclear.  What I meant was that it would be a simple matter for
> > and email provider to recognize a bounce sent via my system.
> 
> And for the gazillion of similar schemes, too? The examples on your web
> site don't look like standard DSNs (you don't even say if the "bounces"
> are sent with an empty envelope from or with <[email-masked]>
> as the mail headers suggest), they look like free form text. Currently
> everybody implementing your scheme is very likely to generate different
> bounce messages - and from experience with handling bogus "a mail you
> sent was blocked because of a virus" messages I can tell you that they
> are not easy to recognize.
> 

I did not specify it on my website, but I envision that the bounces would
have somekind of standard tag that would be used to identify it as a bounce.
This standard tag could be used by a gazillion other schemes that employ
bounces, but I am not aware of any other scheme utilizing bounces that
warrants mass adoption.

> > The email provider could then check to see if the recipient had
> > previously sent out an email to the supposed source of the bounce.  If
> > the recipient had not sent out this earlier email then the bounce that
> > is coming in must obviously be an erroneous bounce and it would then
> > be blocked.
> 
> The supposed source of the bounce is <[email-masked]>.
> Assuming you mean the failed address, how does the MTA get that? Is it
> supposed to parse the English sentence "The following message that you
> sent to [email-masked] was blocked ..." (and its Chinese translation)?
> Please use at least an already standardized format for DSNs (sie RFC
> 3461) if you want at least a small chance that MTAs will behave as you
> expect them to behave.
> 

You are right.  Instead of saying [email-masked] it should say
[email-masked].  I was trying to emphasize that it was an automated email
as opposed to a personally written email.  I will need to correct my website.
 
Michael Kaplan
-- 
_______________________________________________
Find what you are looking for with the Lycos Yellow Pages
http://r.lycos.com/r/yp_emailfooter/http://yellowpages.lycos.com/default.asp?SRC=lycos10

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Sat, 8 Jan 2005 20:02:53 +0100

On 2005-01-08 13:23:39 -0500, Michael Kaplan wrote:
> > > > How will - how *could* - "a few of the large consumer ISPs"
> > > > adopting your system, or any other, prevent a small site
> > > > handling its own mail in, say, San Jose, from sending an
> > > > erroneous bounce to a user at a small site handling its own mail
> > > > in, say, Ottawa?
> > >

Why not use the "standard tag" which exists at least since RFC 821
(August 1982!), the empty reverse-path (MAIL FROM: <>)?

> [email-masked].

I don't think so. The message is not from Joe, it is from the mail
system. Rather, the format of the message should be parseable. Please
read RFC 3461 and RFC 3462 and use this format or explain why it isn't
adequate for your purposes. (That format IS in wide (though
unfortunately not universal) use, and there are already systems which
analyse it to verify bounces).

	hp

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: der Mouse <[email-masked]>
Date: Sat, 8 Jan 2005 22:14:22 -0500 (EST)

> I did not specify it on my website, but I envision that the bounces
> would have somekind of standard tag that would be used to identify it
> as a bounce.

I don't suppose you considered using the existing (de-facto standard,
and de-jure standards-track) mechanisms for this purpose?  Things like
using an empty envelope-from and RFC3462 construction?

/~\ The ASCII				der Mouse
\ / Ribbon Campaign
 X  Against HTML	       [email-masked]
/ \ Email!	     7D C8 61 52 5D E7 2D 39  4E F1 31 3E E8 B3 27 4B