Re: Comments on DSP/RR/SPF drafts

On Mon, Oct 27, 2003 at 09:41:08PM -0800, Raymie Stata wrote:
| 
| I wonder if the solution to the above problem might not be to avoid it
| altogether: use DNS to validate the relaying
| SMTP server (from the HE/EHLO greeting) rather than the return-path.
| (The Wong draft mentions this idea but doesn't really focus on it.)
| 
| At first, it may seem that this provides significantly weaker
| protection than does validating the reverse-path.  However, all
| the reverse-path proposals really do is prevent someone from using
| some random machine as a spam
| mill.  The proposals do NOT prevent a spammer from obtaining a new
| domain, appropriately setting up DNS records for that domain, and then
| spamming away.
| 

Thank you for your comments.

To address the .forward/aliases issue: we are all quite aware of the
magnitude of the problem; at my organization we we have spent at least
man month to date writing and implementing a sender rewriting scheme
which we will release to CPAN when it's ready.  I hope to release an SRS
specification as a companion RFC.

The design goal of my designated sender scheme, at least, is to impose
the unavoidable bulk of the implementation burden on the least number of
entities: while it is true that most of the major universities have
alumni forwarding, most alumni forwarding is provided by a fairly small
number of servie providers.  Similarly, on the query end of things, only
antispam vendors and MTA vendors need to add code.

My company provides email forwarding services to the general public, and
alumni forwarding as well: the University of Texas is one of our customers.
I am quite aware of the implementation burden of any designated sender scheme.

The reason my proposal continues to focus on the envelope sender and not
the HELO name is because there is a crucial difference in incentive:
domains will be motivated to publish SPF records because SPF records
provide the immediate benefit of reducing joe-job forgery of the
envelope sender.  DRIP records lack that property, because joe-jobbing
can still continue under a DRIP universe, and therefore I do not think
they will have as much adoption appeal.

You are welcome to join the SPF mailing list to discuss any further
issues.

cheers
meng