ietf-asrg
[Top] [All Lists]

[Asrg] Re: 0. General - anti-harvesting (was Inquiry about CallerID Verification)

2003-11-30 13:20:26
On Sun, Nov 30, 2003, Scott A Crosby wrote:

[please don't Cc: me]

On Sun, 30 Nov 2003 11:33:33 -0800, Claus Assmann 
<ca+asrg(_at_)esmtp(_dot_)org> writes:

On Sun, Nov 30, 2003, Scott A Crosby wrote:

How to do it is all sending systems attach a nonce (a random number)
to an email. All DSN's must include a nonce indicating to what this is
a response to. Users have the option to filter based on whether a
correct nonce is attached.

There's no need to invent something new. Use the Message-Id: header.

Not quite. This would be something added on by the email server, and
it doesn't need to be unique among all messages and all senders. By
using cryptography, for instance encoding a counter and a MAC over
just the counter, the mechanism can be made *MUCH* cheaper than
recording the message ID's of all sent messages.

That only works if all the MTAs that can receive the DSNs have
"knowledge" of all the mails that could cause DSNs to the domains
for which they are responsible. What if a mail is sent via a
different MTA? Well, maybe you want to forbid that?

Message-Id: works for the end user, it can be implemented in
the MUA; most MUAs allow for threading based on Message-Id:,
dealing with DSNs shouldn't be hard to add.

RFC 3461:
   (d)  preserves sufficient information to allow the sender to identify
        both the mail transaction and the recipient address which caused
        the notification, even when mail is forwarded or gatewayed to   
        foreign environments, and

That RFC also specifies ENVID (in case Message-Id: gets lost.)

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg