RE: The open relay problem.

On Thu, 2004-03-25 at 14:56 +1100, Neil Brown wrote:
> On Wednesday March 24, [email protected] wrote:
> > I suspect that too many mailers return bounces without enough of the
> > original message included. I asked if anyone had numbers to confirm or
> > refute that, but nobody obliged.
> 
> I just got one :-(  Content below if you are interested.

Bear in mind that the mail it's 'returning' probably didn't have a
message-id in the first place. It's not _necessarily_ a case of a mailer
bouncing a mail and omitting its Message-ID.

Looking at the other headers which were included, I'd guess you _would_
have seen a Message-Id: there if the original message had had one.

TBH I wish Message-ID: had been made a 'MUST', but it's not. Still, I
elect not to accept any messages without it. It's largely crap -- if
it's not a virus it's often some broken MTA with broken References: and
top-posting. 

> It does seem to make universal SRS more attractive, and the arguments
> against it are hard to sustain.
> 
> I would just really like a fairly reliable "sender" address, and some
> indication of how reliable it was.  MAIL FROM seemed to be that, and
> SPF seemed to give a good measure of reliability.

Sender verification callouts give you _some_ indication of how reliable
it is, and have done so for years. You check the sender address will
accept a bounce. The recent trend to refusing MAIL FROM:<> to addresses
which _never_ send mail makes that indication _more_ reliable, and doing
SRS on all outgoing mail so that even 'real' addresses can refuse MAIL
FROM:<> makes it even more reliable.

>   But if people start re-writing the MAIL FROM header whole-sale, and 
> quite possibly in subtly different ways, then that seems to put a big 
> hole in what I thought SPF would give me.

Does it? SPF only looks at the domain, and nobody's really rewriting the
_domain_ part of their own outgoing mail, surely? 

(OK, I am -- but that's just because I wanted more diagnostic
information in the address than the SRS scheme or the 64-char limit
permitted, and I was willing to overcome my distaste for wildcard MX
records to achieve that. And I don't rewrite the domain in ways that it
affects SPF.)

I think SPF is seriously misguided, and I'm trying to achieve its aim in
other ways -- but I'm not setting out to actively break it, and I don't
think I've done so. I think it's broken enough already.

-- 
dwmw2