Matthew Elvey <matthew(_at_)elvey(_dot_)com> wrote:
Any news on further work from the LMAP group - a revised LMAP Discussion
and Applicability Statement? An LMAP design document?
I'm currently working on updating the discussion paper.
There isn't a design document. Instead, I'm working in another
document which compares the technical details of the various
proposals.
Another suggestion for the Statement: it should go over WHY it does not
examine or verify the body From: field - which, IIRC, a post to this
list went over - there's a case or two where it's legitimate for it not
to match, yes? -e.g. legitimate relaying and forwarding?
Yes. The document discusses forwarding. It doesn't discuss
legitimate relaying.
I find it interesting that in all of the discussions surrounding
RMX-style solutions, I don't recall anyone mentioning off-site MX
secondaries. So far as the primary MX is concerned, they're
authorized relays. But the secondary SHOULD also apply as much as
possible the same filtering schemes to the messages, otherwise
spammers can use it as an "open relay" to the primary.
Expanding on Yakov's and PHB's comments: LMAP's being domain specific
instead of network specific is a strength not a weakness, because of who
it puts in charge of creating/maintaining the authorized sender info.
Exactly.
In addition, while spammers can currently use any IP to send spam,
LMAP gives the recipient something *other* than a random IP to blame:
the domain. So spammers have to do more work to find domains with
permissive LMAP information, and the recipient has one more piece of
information to use in applying content filters.
It's not about LMAP solving the worlds problems. It's about a
system of layered defences against spam. LMAP is just one piece of
the puzzle.
Alan DeKok.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg