On 10/18/11 12:42 PM, Daniel Feenberg wrote:
On Tue, 18 Oct 2011, Murray S. Kucherawy wrote:
After some chatter inside MAAWG and on the ietf-smtp mailing list,
I’ve started an
outline for a BCP on the practice of greylisting. The main purpose is
to explain
what it is, discuss the pros and cons of its variants, and give some
recommendations
for implementation and configuration for a few example installations
and policies.
The draft (which is currently only an outline) is here:
https://datatracker.ietf.org/doc/draft-kucherawy-greylisting-bcp/
Comments welcome.
Where should comments go? I have a question really, though it might be
construed as a comment. Why do greylisters match on the (sender,
receipient, MTA) triple rather on just the MTA? Isn't it nearly
certain that if an MTA returns for one sender/receipient pair, it will
return for any pair? So that keeping track of all three seems
unnecessary and increases the probability of a message being delayed.
What am I missing?
Grey listing challenges stateful processing of the sender to test an
often erroneous assumption that bots sending spam don't maintain state.
Thanks to grey listing, many bots retry against the same recipients,
just not always with the same message. Heuristic methods are quickly
defeated once deployed on enough systems. Defining practices for failing
concepts seems misguided since such heuristics are likely to make other
erroneous assumptions related to the nature of the outbound MTA.
We employ temp errors to prioritize limited resources which may delay
sources with lower reputations. When they are in the middle of some
campaign, the delay may persist until their run completes. There would
not be any way to predict how long that might take, nor would any hint
likely affect the average bulk sender focused on completing their runs.
We are about to publish a list that categorizes this type of behavior.
I agree it would make more sense to focus on knowing which domain
_controls_ the outbound MTA without umpteen additional transactions.
With outbound MTA authentication, receivers would have a sure and robust
basis for avoiding abusive transactions, where grey listing would be
considered wasted efforts.
-Doug
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg