--On 19 June 2009 11:23:42 -0600 "J.D. Falk"
<jdfalk-lists(_at_)cybernothing(_dot_)org> wrote:
Ian Eiloart wrote:
Which is why I said it has to be done the other way around. Some
organisation with a significant email user base needs to take a lead on
this. It could be a large ISP, a large webmail provider, a government,
or some other body. It has to be done before the situation gets out of
hand, though.
If the ASRG were to publish some research showing that this is a good
idea, it'd go a long way towards convincing one of those organizations
you mentioned to consider implementing it.
So, to demonstrate that it's a good idea, we need to show:
1. That there's lots of spam on the Internet, people don't like it, and it
costs lots of time and money.
2. The spam is hard to identify, because there's no traceability. People
like to whitelist or blacklist sender email address or sender email
domains, but they're too easy to spoof because of the lack of traceability.
3. It would be nice to require traceability for new mailers, but it's hard
to know which are new.
4. Except that IPv6 mailers are new, or recently deployed.
5. People with recently deployed IPv6 mailers are likely to have the
ability to implement traceability.
6. The cost to the community of requiring traceability for IPv6 email
servers would be low.
7. The reward would be that a whole class of easily identified new servers
would have the traceability required.
8. When deploying IPv6 to customers, ISPs would have to take no special
measures to prevent customer machines from emitting spam. They'd be
secure(ish) by default.
Oh, and we have to figure out what form of traceability we're looking for.
Let's start off with this list for a suggestion:
1. Reverse DNS records for the sender's IP address.
2. SPF or DKIM passes for the sender's IP address.
3. Strict checks on EHLO string.
And, for an IPv6 hosts receiving email, there must be an MX record.
--
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg