Re: CBV

In <4FD2C985D5E2A642AE25823DFD61C2B0C0E0D1@orca.agcom.amgreetings.com> "MW Mike Weiner (5028)" <[email protected]> writes:

> Not to belabor the point, and since I am in this thread a little late,
> could someone please provide me a link to the CBV stuff so that I might
> review the protocol?

CBV == "Call-back Verification"

The idea is that when you get mail claiming to be from
"[email protected]", you try to send a bounce back to that address.  You
stop before you actually send the real message, so legitimate email
accounts won't get these test messages, but if example.com rejects the
email, you can be pretty safe in rejecting the email claiming to be
from them.

So, the sequence of events looks like this:

hacked-dsl.com connects to my-mta.com
hacked-dsl.com ->: HELO junk
my-mta.com     <-: 250 Ok
hacked-dsl.com ->: MAIL FROM:<[email protected]>

   my-mta.com connects to example.com
   my-mta.com ->:  HELO my-mta.com
   example.com <-: 250 Ok
   my-mta.com ->:  MAIL FROM:<>
   example.com <-: 250 Ok
   my-mta.com ->:  RCPT TO:<[email protected]>
   example.com <-: 500 invalid user "foo"
   my-mta.com  <-: QUIT

my-mta.com     <-: 500 call-back verification failed for <[email protected]>

hacked-dsl.com ->: AUIT

It is important to always use a null envelope from (the "<>") when
doing a CBV to prevent loops where each domain keeps making additional
CBVs to eachother.  For some reason, postfix uses the email address of
[email protected] (or whatever the domain) anyway.


Due to the overhead of TCP connection setup and teardown and the
slow-start TCP window size, a CBV is almost as expensive as actually
delivering email.  All this has to be done *while* the original SMTP
session is taking place.  Many people consider this "too expensive"
and claim that it "doesn't scale".  I agree that it is kind of
expensive, but it will never go beyond a factor of 2.  With email
volumes double every year or so, this just means that the resources
needed to do CBV in 2004 is what you would need in 2005 anyway.
Still, people complain about it.

A more valid complaint is that since spammers often forge email
addresses on large spam runs, if everyone did CBV, an small company
that has the unfortunate luck of being used by a large spammer can
have their MTA tied up for hours or days.



-wayne