Subject: Re: [Asrg] where the message originated (was: DKIM role?)

From: Franck Martin <[email-masked]>
Date: Fri, 9 Jan 2009 09:05:41 +1200 (FJT)

on 4) for information there is this blocking list:
http://www.uceprotect.net/en/rblcheck.php?ipr=202.170.42.206

but it tends to block by AS number and in the above case, AS9241 is the whole country of Fiji.

Also as a note, I think dealing with high volume mail sender is not the issue, they are known, we know their technics, etc... it is more to deal with the long tail of little companies, organisations, small ISPs, etc..

----- Original Message -----
From: "SM" <[email-masked]>
To: "Anti-Spam Research Group - IRTF" <[email-masked]>
Sent: Friday, 9 January, 2009 8:43:58 AM (GMT+1200) Auto-Detected
Subject: [Asrg] where the message originated (was: DKIM role?)

At 12:10 08-01-2009, Douglas Otis wrote:
>There are methods that can be used to limit risks related to
>whitelisting domains.  Often these involve capturing prior
>conversations and noting where the message originated.  The locations
>might then be expanded to CIDRs, routes, or acquired address lists.

Is it that important to note where the message originated?  Although 
the where is commonly used as input for lack of a better reference 
point, it can be a problem when renumbering a network or for mobility.

Did this message reach you because:

  1. it came from the irtf.org domain

  2. it came from the ASRG email address

  3. it came from an IP address associated with 1 or 2

  4. it came from a CIDR block you view as "safe"

Regards,
-sm

P.S. You may decide not to answer the above question to limit the 
risks related to whitelisting. 

_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg
_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: SM <[email-masked]>
Date: Fri, 09 Jan 2009 12:30:32 -0800

>the whole country of Fiji.

That shouldn't be a problem if you don't communicate with people from Fiji. :-)

>Also as a note, I think dealing with high volume mail sender is not 
>the issue, they are known, we know their technics, etc... it is more 
>to deal with the long tail of little companies, organisations, small 
>ISPs, etc..

Some receivers may view these small organizations as statistically 
insignificant.  These small organizations generally adopt antispam 
policies without analyzing whether such policies can have a negative 
impact on them in future.

At 09:44 09-01-2009, Douglas Otis wrote:
>White-listing based upon a domain would be dangerous without also
>including the IP address of the SMTP client and message tracking.
>There are companies currently providing this service, particularly
>needed where spam remains largely unmanaged.

The question was whether it is important to note where the message 
came from.  I take it that your answer is yes.

>The algorithm can remain oblivious to who owns the SMTP client.  It
>determines whether a conversation was observed, while also allowing
>also users to submit corrections.

That only works as long as the two end-points for the conversation 
are static.  Such a constraint is only acceptable to users until they 
move around and experience a communication failure.

Regards,
-sm 

_______________________________________________
Asrg mailing list
[email-masked]
http://www.irtf.org/mailman/listinfo/asrg