If I were a spammer sending Ci(_at_)l1s spam through zombies on
MSN and Comcast, I agree that this is the SPF record I would
use. ...
You get to piggyback on MSN's reputation exactly when you send mail
through their mail servers. If MSN has a reputation for not sending
spam, and you get my domain's mail from MSN's servers, then you can be
assured it's not spam, because if I try to send spam, MSN will either
kick me off, rate-limit me, or fine me. ...
I understand this argument, but it still strikes me as utterly
unpersuasive. For one thing, this kind of piggybacking only makes sense
when networks don't have unauthorized users, which means no zombies, and I
doubt that any plan that only works when the zombie problem is solved will
be usable soon enough to be interesting. If I were that C1(_at_)lis spammer
sending out tons of spam through WBW (an ISP with a dreadful reputation),
I'd publish SPF saying that I use MSN, Comcast, and WBW. I might even
sign up for a few MSN and Comcast accounts and trickle out a little mail
through them. What reputation do I get? The max? The min? The median?
The one whose IPs a particular message came through? That's in effect an
IP based reputation system, which I don't think has a lot of support in
MARID, given the modest enthusiasm I've seen for CSV.
At least as important, MSN and Comcast are going to have reputations that
say these are large consumer ISPs with 24/7 abuse desks and other facts
that don't trickle down to their customers. They may or may not be
willing to vouch for various characteristics of some or all of the domains
that their customers use, but they get to decide, not you or me.
In short, discontinuous changes of format seldom happen.
Indeed. They only happen when they're useful. You cited http as an
extensible format a little while ago, and I can't help but notice that
extensible http 1.0 is quite incompatible with non-extensible http 0.9,
yet everyone adapted because 1.0 has advantages that made the transition
worthwhile.
This still boils down to "it might be useful". I have lots of swell
anti-spam ideas that might be useful, but I'm not going to tell people to
build standards around them until I have some experiece that demonstrates
how useful they are.
Regards,
John Levine, johnl(_at_)iecc(_dot_)com, Primary Perpetrator of "The Internet
for Dummies",
Information Superhighwayman wanna-be, http://iecc.com/johnl, Mayor
"I dropped the toothpaste", said Tom, crestfallenly.