Re: SPF and bouncing

On Fri, 4 May 2012, alan wrote:
> whitelisting VERP senders is common and easy, or no 'goldlister' could
> ever subscribe to any mailinglist,

I wouldn't quite call whitelisting mailinglists a solved problem yet.  I
do it, but it's a hack that occasionally fails.  The key problem is that
for many mailing lists, including this one, the MAIL FROM: domain of the
distributed messages ("jeeves.archive.listbox.com") is not the same as
that of the submission address ("listbox.com").  The former sometimes
changes abruptly (this list was "v2.listbox.com" before 2007).

> simply accept mail from *@whitelinsted-domain at rcpt (assuming spf
> pass /helo/ptr/dnsbl etc.) then check for From: Sender: etc containing
> whitelisted-sender@whitelisted-domain at data (and if from non-whitelisted
> neighbour reject)

That lets too much stuff through to DATA.

True, an expert user with access to logs can recognize VERP and manually
tell his server to demangle the addresses coming from that site.  But I
want to aim higher and make whitelisting work for more casual users, by
making the demangling instructions *public*.

> spf is a tool for sender validation, and expression of the senders
> policy of what should happen to invalidated mails, it has no place for
> specifying the senders wilingness or unwillingness to receive/refuse
> bounces, and shouldn't

You're attacking the wrong prong of my fork here.  I'm discussing a
proposal to but a flag in SPF records advertising that VERP is in use and
a defined way to decode it.   Thus allowing the recipient to obtain the
whitelist lookup key without going to DATA.

(The fork is because we cannot reach agreement on whether deliveries
coming from a site with a "?a -all" SPF record are absolutely
irreversible, not even for quota problems.

If one thinks so (as I do), then a qualifier that says "just as much
confidence the message is unforged as pass, however bounces are still as
unacceptable as if neutral" is needed.  It would belong in SPF because it
would be *fixing* an unwanted connotation of regular SPF pass.

If one thinks not (as you, Alan, do), then the qualifier is pointless, but
now we will need VERP, and thus measures to stop VERP from poisoning
whitelisting.  This belongs in SPF because SPF depends on whitelisting to
avoid being abused by spammers who generate publish SPF records on their
throwaway domains.)

---- Michael Deutschmann <[email protected]>