Subject: Re: IETF 58 v6ops meeting baker-ipv6-renumbering slides

From: Randy Bush <[email-masked]>
Date: Mon, 10 Nov 2003 10:00:45 -0600

> I sent a note earlier and for some reason it has not arrived back at my 
> machine. Hmmm.

perhaps it was this entry in the mail log here?

2003-11-10 14:47:10 H=(sj-iport-3.cisco.com) [171.71.176.72] F=<[email-masked]> rejected RCPT <[email-masked]>: Unknown local part
                                                                                                 ^

---

From: Fred Baker <[email-masked]>
Date: Mon, 10 Nov 2003 10:05:57 -0600

At 10:00 AM 11/10/2003, Randy Bush wrote:
>2003-11-10 14:47:10 H=(sj-iport-3.cisco.com) [171.71.176.72] 
>F=<[email-masked]> rejected RCPT <[email-masked]>: Unknown local part

You're saying I fat-fingered the address?

Sounds like a reasonable explanation...

---

From: Randy Bush <[email-masked]>
Date: Mon, 10 Nov 2003 10:13:26 -0600

> You're saying I fat-fingered the address?

close.  i am asking if this was possible.  you could/should have
received a bounce for that.  and, if you did, you might have resent.

but perhaps this is not the best forum for smtp debugging :-)

randy, a cautious debugger

---

From: Fred Baker <[email-masked]>
Date: Mon, 10 Nov 2003 10:28:23 -0600

>>At 10:13 AM 11/10/2003, Randy Bush wrote:
>>>F=<[email-masked] rejected RCPT <[email-masked]: Unknown local part
>>

It's probably not the right forum, but a symptom here may be of interest to 
some operational forum, perhaps asrg.

Yes, as it turns out I did get such a bounce.

I have a problem.
  - The email address "[email-masked]" is in everybody-and-their-dog's
    outlook address book.
  - Everybody-and-their-dog gets viruses (pithy comment on people that click
    on things that say "click me, I dare you" elided)
  - viruses send messages *from* every address in the outlook address book
    *to* every address in the outlook address book.
  - half of those addresses are no longer valid, or are the addresses of
    mailing lists that are inadequately maintained.
  - hence, a significant subset of my spam load is email bounces
  - My spam filter helpfully detected the bounce from ops.ietf.org and put
    the message into a file I only occasionally look at.

I'm of the opinion that there is an operational issue here. One technique a 
spammer can use to validate his email alias is to send messages to random 
addresses. If he gets a bounce, it was an invalid address. If he doesn't 
get a bounce, there was in fact a target there, although the target may be 
using antispam measures.

Hence, the bounce is an attack avenue for spoofed senders and a security 
hole for private networks.

Um, maybe there is some form of policy that should be recommended for 
bounces, such as "only send them to some specified set of correspondents" 
such as a local alias comprised of the or of all local aliases.

Let's see; that had something to do with IPv6 operations, right?

I now return you to your regularly scheduled mailing list topic...