ietf-mxcomp
[Top] [All Lists]

Re: Sender-ID != SPF

2004-10-29 18:07:11

On Fri, 2004-10-29 at 16:39, Alan DeKok wrote:
Douglas Otis <dotis(_at_)mail-abuse(_dot_)org> wrote:

How does one establish a mix of divergent approaches?  A chain
of trust is broken when each node checks a different mailbox-domain.  It
is also seemingly inappropriate to misapply a record intended for a
different mailbox-domain.

  I agree completely.

  We should start with fields which have simple, well-known semantics
such as EHLO, and then work our way to fields which have complex,
poorly understood semantics.

The goal should be directed toward ensuring security and responding to
apparent breaches.  Reputation should be based upon the response to
notifications and must directed to the entity able to take immediate
action. To ensure these notifications are not based upon spoofed
identifications, this identity should also be directly validated. 
Spammers are good at injecting noise into an abatement effort. Security
is the challenge, as breaching security is the common enabler for much
of the spam. 

Handing multiple accountable identities is daunting, especially when
a change in convention between administrative domains makes spoofing
easy.

  If we ensure that the MTA's are individually accountable, and that
each message is authenticated and tracked through the system, then
spoofing becomes much more difficult.

By separating the accountable entity from a mail-channel description,
individual MTA administrators are revealed.  By taking this approach,
the mailbox-domain compared to a mail-channel description becomes less
critical, as the mail-channel is not assessed for a reputation.

The mail service provider could protect themselves by asserting the
large customer's domain when sending their mail. 

  SMTP is not currently such a system.

It could be with a deceptively simple change.

-Doug




<Prev in Thread] Current Thread [Next in Thread>