In
<1078855655(_dot_)867(_dot_)58(_dot_)camel(_at_)hades(_dot_)cambridge(_dot_)redhat(_dot_)com>
David Woodhouse <dwmw2(_at_)infradead(_dot_)org> writes:
Sorry, I was unclear. Of course I agree that a large percentage of MAIL
FROM: addresses are bogus. It was the claim that best current practice
is to '*NEVER* use the MAIL FROM address for anything' to which I
objected.
<...>
While I think there can be a lot of useful discussion about what the
semantics that SPF defines for the MAIL FROM address and the HELO
domain should be, the immediate problem is to enlighten people that
these strings are currently dangerous to use in any way.
You appear to still be advocating using the MAIL FROM address to send
bounces to. As a result, you are advocating abusing innocent third
parties.
We seem to agree that one should do one's best to avoid generating
bounces. As much as possible should be rejected at SMTP time.
I mostly agree with you here, with the exception of how we define "as
much as possible."
[problems of being a good secondary MX deleted]
We seem to disagree on what should be done in _that_ situation. You
presumably would blackhole the mail, giving no indication to a
potentially valid sender that the mail didn't get to its intended
recipient.
I refuse to do that; I prioritise the correct and reliable operation of
_valid_ mail, including the generation of bounces to genuine senders,
over the desire to filter out the noise.
Well, it all depends on your priorities.
If you think that a lost bounce is more important than abusing
innocient third parties, and your ISP lets you get away with abusing
innocient third parties, then go ahead and put your customers
interests ahead of everyone else. Chances are, you are generating far
more bounces to innocient third parties than to legitimate senders and
you may end up on DNSBLs for this reason.
I would claim that my version is also best current practice, unless
we're prepared to admit that the spammers have won to the extent that
we're deliberately deciding to make the system unreliable in a vain
attempt to keep the noise down.
I do not admit that the spammers have "won". I do think that spammers
have made any use of the MAIL FROM address very dangerous. I do think
that all too many mail admins have decided that it is better to
silently drop email rather than generate a bounce.
Right now, the reality is that we have these three choices:
1) reject email during the SMTP session.
2) accept email and silently drop it instead of creating a bounce.
3) accept email and abuse innocent third parties by sending them bogus
bounces.
What I am advocating is that we need to be able to add a fourth
option:
4) send bounces *IF AND ONLY IF* the MAIL FROM passes a designated
sender system, such as SPF.
Even with this fourth option, I think we should still try very hard to
reject email during the SMTP session.
-wayne