Re: Scope of SMTP Verify

On Tue, 2 Mar 2004, Alan DeKok wrote:

> "Peter J. Holzer" <[email protected]> wrote:
> > I can think of several items which can be verified at the SMTP level
> > (not necessarily in any useful order):
> ...
>   I'm starting to think that the most important question is:
>   - Is this machine an MTA which will accept mail, too.
>     If not, why am I accepting mail from it?
>     Why is it not using it's own MTA to send mail?
>     What's wrong with SUBMIT, or SMTP over SSH?

It is becoming clear that one of biggest problem as far as spam sources 
are zombie PCs. It many cases, these computers would not be able to run 
mail server, so being able to tell that if incoming connection can also 
receive SMTP call is good. At the same time remember that some ISPs do 
have mail server computers only used for sending email out of their 
network, so have to be carefull. Also its not unexpected that if just 
checking "if server is accepting SMTP" method becomes used that spammers 
would modify their software and open port25 on zombie pcs (not always 
100% effective because some of these pcs are behind simple NAT firewalls).

One of the things I think that can help decreasing effectivness of zombies
(and that is fairly safe as far as possible negative consequences) is 
allowing ISPs to advertise that some of their ips can not be used as 
source of SMTP traffic (unless authentication is involved), I know this 
can already be accomplished with certain DNSBL but ISPs do not often like 
to contact somebody else and let them know - they prefer to be able to 
control this themselve - at the same time if this is an informational RFC 
some cooperation in adding the records can be expected. While I do not 
particularly like LMAP, it does seem that if this is adopted the same or
very simiilar syntax can be used to add records to reverse dns IN-ADDR zones
Things you may want to indicate there include:
1. If the ip (or ip block) can be source of SMTP traffic or not. Possibly 
   even more specifically on what authentication is to be used (i.e. AUTH, 
   STARTTLS)
2. What domain(s) can be used for envelope from when email is being sent 
   from that ip (negative consequence: spammer can also see this record 
   and may well choose to forge emails as coming from that domain)
3. If ip is particular to certain server or user, the record may indicate
   public key and all legitimate emails sent from that PCs should then 
   have been signed by private key associated with that public key
Note: this does not have to befully signed email but possibly domain-key 
code as with yahoo proposal or similar - I actually rather like yahoo's 
proposal as opposed to LMAP.

This is something that ASRG may want consider to decreasse availability of 
zombies being used for spam.

William