Re: homework, not an experiment, draft-crocker-email-deliveredto

On Tue, Aug 03, 2021 at 08:25:11AM -0400, Sam Varshavchik wrote:

> > Some abuse of Delivered-To to trigger bounces has been reported now and
> > then, and the idea of obfuscated Delivered-To: had been discussed, but
> > has not yet been implemented.  The freedom to do that some day remains.
> 
> I don't see anything intrinsically wrong with this, by itself. It's better  
> than nothing. But if the actual goal is to prevent proxy DDOSes, this should  
> be addressed directly: no bounce should be sent via SMTP for mail that was  
> accepted via SMTP.

Getting rid of all after-queue bounces is too drastic a step.  It could
some day prove necessary, but I don't think it is warranted at this
time.  A more conservative change (already possible, but not enabled by
default in Postfix) is to always include only the headers in bounces
(text/rfc822-headers):

    https://datatracker.ietf.org/doc/html/rfc3462#section-2

That should have been the required format for bounces of EAI mail,
obviating the need for the message/global (transfer-encoding of
composite MIME parts) abomination.

-- 
    Viktor