Reporting targets, was SPF's helo identity as a

On Mon 14/May/2012 10:48:08 +0200 Chris Lewis wrote:
> On 12-05-13 02:40 PM, Alessandro Vesely wrote:
>> On Sun 13/May/2012 20:13:44 +0200 Chris Lewis wrote:
> 
>>> There are other ways of doing this that doesn't require ancillary gunk
>>> like SPF. There's at least one IP-based DNSBL that yields the same data.
>> 
>> Which one do you mean?  DNS lists like abusix get their data from
>> RIRs' whois databases.
> 
> That's an implementation detail.  There's no reason that they'd _have_
> to.  Mine doesn't rely on whois for responsible domain or abuse contact.
> While it does the published RIR maps for allocations and countries, it
> does no whois queries.

And how does it discover abuse contacts?

> abuse.net's doesn't use whois for anything.

Yes, but it's not IP-based.  It falls back to RFC 2142 role addresses,
and relies on cooperative contributions (I think).

> I don't think Cymru's or Mynetwatchman's does.

Thanks for the pointers, I'll take a look at them.

> It's _very_ hard to get domains from whois in an even remotely "global
> sense", let alone abuse addresses.
> 
>> In that case, virtual MTA providers would have
>> to restrict their choice of network providers based on proper
>> management of whois records, besides cost, bandwidth, uptime, support, ...
> 
> "Proper management" of IP whois records is probably coming as unlikely
> as it seems, so another reason for it wouldn't hurt.

That would be a Good Thing.  However, it may appear a double-edged
sword, as it hides the network provider's abuse team.  One could
navigate whois records hierarchically, so if the virtual MTA operator
is a bad guy, the abuse contact at the upper level should be its
network provider.  This operation can be done recursively, but
homogeneity may obscure awareness.  That is, by climbing the tree all
the way up, one eventually gets at IANA's --which hopefully will never
be a bad guy-- but might not realize what role corresponds to each level.