Re: delineating DRIP

Meng Weng Wong wrote:
> 
> On Wed, Oct 08, 2003 at 01:03:13PM -0400, Alan DeKok wrote:
> |
> |   The use of DNS-based filtering on EHLO/HELO has many fewer problems
> | and issues than that for MAIL FROM.
> |
> 
> From the point of view of an ISP, designated sender schemes are good for
> three reasons:
> 
>  1) because we can perform DS checks, we get fewer spams coming in.
>  2) specifically, because the checks occur before DATA, we save bandwidth and CPU.
>  3) because SPF/RMX/DMP protect mail-from, we get fewer spam/virus bounces.

4) because DRIP protects HELO, we get fewer direct to MX spams and viruses from
	compromised hosts.
5) Unix (like) .forwards and aliases break.

> 
> My understanding of DRIP is that it does not share #3.
> 
> Is that correct?

That is correct but RMX/DMP/SPF/Vixie does not share #4.
And DRIP does not share #5.

> It seems to me that DRIP is most similar to PTR checks --- if the
> sending host has no PTR records, it's not "designated".  It is more
> flexible because vanity domains on broadband nodes can create records
> for DRIP, but not for PTR.

Similar but DRIP goes beyond PTR checks. The client MTA must be ACTIVELY
designated by a specific A (AAAA) RR.

> In a DRIP world, ISPs are likely to suffer a higher spam/virus bounce
> rate than in an RMX/SPF/DMP world.  Is that correct?

If the two worlds were mutually exclusive, the DRIP only world have more
forged sender domains than the RMX/DMP/SPF/Vixie only world since it does
protect the sender domain from forgery. The RMX/DMP/SPF/Vixie only world
also breaks important, useful, and used email functionality.


Raymond S Brand