Discussion:
SPF and bouncing
Michael Deutschmann
2012-04-03 19:36:55 UTC
Permalink
Recently I've been pondering one simple question:

"Is it okay, on the modern internet, to send a bounce message outside
of one's own bailiwick, when the original message had an SPF Pass
result?"

Without an SPF pass, the consensus is clear -- bouncing is unacceptable
because it risks backscatter. (So all mail accepted by an MX must be
delivered all the way forwards, explicitly ignoring any local policy
preference to the contrary.)

Until recently, my answer to the question was "Yes. Although it hasn't
come up in practice yet, so the ground may not be firm...", as
backscatter is impossible with an SPF Pass based on a sane SPF record.
(If the SPF record is insane, it's the backscatter victim's own fault.)
However, lately I'm starting to doubt it.

The problem is this: The original sender may be not only publishing his
own SPF policy, but using SPF lookups in combination with a whitelist to
decide whether to accept mail. Now, if the reputation of the bouncing
site is not good enough for that sender to accept mail from someone not
whitelisted, then they won't accept the bounce either, since bounces are
sent from <>.

So, the answer then is "No. Unlike the non-SPF case, you won't make
anyone angry. But there's still a substantial risk of double-bounce,
which you can avoid by remaining as cautious as if there were no SPF."

On the other hand, there are lots of special cases where an SPF pass
message could be bounced. If no sender-address whitelists are used, or
they only serve to stand down content filters, a bounce is unlikely to
fail. And VERP allows legitimate bounces to be recognized, at a cost of
complicating whitelisting at the other site.

There is a small incentive for a site to permit bouncing. A backup MX
serving multiple domains might reserve a portion of it's queue space
only for bounceable messages. Then, if a mailbomb occurs against a
mailbox with a primary that is down, the server can continue to accept
only Pass mail in hopes that the server will come back up, knowing that
it *can* flush the queue buildup without operator attention if it has
to. Unknown/Softfail/None mail would simply be deferred until the
messages presently sitting in the queue can be unloaded forwards.

So, it might be reasonable to add a modifier (to SPFv1), or a new
qualifier (in SPFv3), that indicates "Pass, and I'll accept bounces in
potential return of faster delivery."

(Note that my Substitute Whitelist Key proposal from 2008 would have
resolved this problem, as it would allow both for VERP/whitelist
co-existance and for the failed-sender of a bounce to be indicated to
the SMTP server in the MAIL command.)

---- Michael Deutschmann <***@talamasca.ocis.net>
Stuart D Gathman
2012-04-03 20:31:57 UTC
Permalink
Long ago, Nostradamus foresaw that on Apr 3, Michael Deutschmann would write:

> So, the answer then is "No. Unlike the non-SPF case, you won't make
> anyone angry. But there's still a substantial risk of double-bounce,
> which you can avoid by remaining as cautious as if there were no SPF."

What double-bounce? By definition, there should never be any bounce
to MAIL FROM <>. If the original sender won't accept the <>, then it
gets logged and goes in the bit bucket (and they never find out that
they mistyped the address - you don't accept DSNs, you don't find out
such things, duh!). You MUST NOT bounce a message with MAIL FROM <>.
Michael Deutschmann
2012-04-03 21:07:27 UTC
Permalink
On Tue, 3 Apr 2012, Stuart D. Gathman wrote:
> > So, the answer then is "No. Unlike the non-SPF case, you won't make
> > anyone angry. But there's still a substantial risk of double-bounce,
> > which you can avoid by remaining as cautious as if there were no SPF."
>
> What double-bounce?
Semantics problem. For me, the term "double-bounce" has always meant the
event that is supposed to occur when a normal bounce receives a 5xx
in-transaction or times out: the message goes into a deadletter file on
the last server it reached.

This is still bad for that server, as the deadletter archive will grow
without bound unless an operator checks it from time to time. If you
just archive to /dev/null, you create the blackhole issue where someone
might never know they mistyped an address.

(And this is a selfish incentive to use backscatter-proof mail
arrangements, even if you aren't afraid of UCEPROTECT's backscatter
DNSBL.)

> By definition, there should never be any bounce to MAIL FROM <>.
There can't be. To what IP address would you say "EHLO example.org; MAIL
FROM: <>; RCPT TO: <>; DATA ..."?

Anyhow, such silliness is not what I meant by "double-bounce".


Although I'd note that disabling SMTP's anti-loop mechanism by using the
failed address instead of <>, would avoid the whitelist problem I'm
discussing. No, I'm *not* recommending anyone do that!

SWK would fix it by allowing the sender to *simultaneously* publish <> for
return-path purposes only and the failed address for whitelist purposes
only.

---- Michael Deutschmann <***@talamasca.ocis.net>
Stuart D Gathman
2012-04-03 22:34:27 UTC
Permalink
Long ago, Nostradamus foresaw that on Apr 3, Michael Deutschmann would write:

> This is still bad for that server, as the deadletter archive will grow
> without bound unless an operator checks it from time to time. If you
> just archive to /dev/null, you create the blackhole issue where someone
> might never know they mistyped an address.

If you don't accept DSNs, you don't get notified about mistyped
addresses. There is logically no way around that. If you don't send
a DSN they don't find out either. So yes, rejected DSNs go into
a black hole or rotated log.
Michael Deutschmann
2012-04-03 23:00:06 UTC
Permalink
On Tue, 3 Apr 2012, Stuart D. Gathman wrote:
> If you don't accept DSNs, you don't get notified about mistyped
> addresses. There is logically no way around that. If you don't send

You can do what we're (TINW) already doing: use blacklists to terrorize
every mail admin into verifying mailbox existence in-transaction. So typo
notification comes via in-transaction 5xx and not a bounce.

Sure, a bounce will probably be involved at some point, going from your
own smarthost to your own incoming mail repository. But that's an
in-bailiwick bounce. A spam can't pretend to be such a bounce, so those
*can* be given absolute right-of-way.

It's the bounce arising when someone else's backup MX can't deliver to
that same someone else's incoming mail repository that is the problem.

---- Michael Deutschmann <***@talamasca.ocis.net>
Stuart D Gathman
2012-04-03 23:53:42 UTC
Permalink
Long ago, Nostradamus foresaw that on Apr 3, Michael Deutschmann would write:

> On Tue, 3 Apr 2012, Stuart D. Gathman wrote:
>> If you don't accept DSNs, you don't get notified about mistyped
>> addresses. There is logically no way around that. If you don't send
>
> You can do what we're (TINW) already doing: use blacklists to terrorize
> every mail admin into verifying mailbox existence in-transaction. So typo
> notification comes via in-transaction 5xx and not a bounce.

Well, if you still needed proof that alias forwarding is broken, there
you have it. Those that will not accept SPF end up banning DSNs instead.
Michael Deutschmann
2012-04-04 07:19:43 UTC
Permalink
On Tue, 3 Apr 2012, Stuart D. Gathman wrote:
> Well, if you still needed proof that alias forwarding is broken, there
> you have it. Those that will not accept SPF end up banning DSNs instead.

I don't see how "accepting SPF" can help save bounces or forwarders. SPF
is certainly an annoyance to forwarders.

At present, SPF is nowhere near deployed enough (senderside) for it to be
viable to refuse all mail not bearing an SPF Pass or <>. Since the
Conspiracy Against Bouncing has decreed that lack of SPF information is
not an excuse to emit backscatter, that means that mailservers have to
be prepared to accept unbounceable mail.

If SPF deployment did rise to that level, the past experience with the
conspiracy will make actual bounces rather rare. At the same time,
spammers will be tempted to use the <> sender to save the trouble of
making throwaway domains. So spamfilters will block all attempts to use
<>; thus bouncing will still be unusable.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-04 11:34:07 UTC
Permalink
At 08:19 04/04/2012 Wednesday, Michael Deutschmann wrote:
>On Tue, 3 Apr 2012, Stuart D. Gathman wrote:
>> Well, if you still needed proof that alias forwarding is broken, there
>> you have it. Those that will not accept SPF end up banning DSNs instead.
>
>I don't see how "accepting SPF" can help save bounces or forwarders. SPF
>is certainly an annoyance to forwarders.
>
>At present, SPF is nowhere near deployed enough (senderside) for it to be
>viable to refuse all mail not bearing an SPF Pass or <>.

its not an OR equation mail from <> still has an spf result based on the helo of the connecting server

either way people still have to accept spf neutral mail froms and <>

(<> is used for more than bounces if you bother to look)

>Since the Conspiracy Against Bouncing has decreed that lack of SPF information is
>not an excuse to emit backscatter,

spf has nothing to do with backscatter (spf allows those guilty of creating backscatter to reduce their volume by /dev/nulling the backscatter they would generate IF the original mail failed SPF)
either way those generating backscatter should instead fix their mailsystems and thus eliminate the problem (instead of wasting time with volume reduction stratagies involving spf/dkim etc)

>that means that mailservers have to be prepared to accept unbounceable mail.

the opposite they should accept or reject at their edge, once the decision is made though they should not later change their minds.

>If SPF deployment did rise to that level, the past experience with the
>conspiracy will make actual bounces rather rare.

what conspiracy?? what agenda do you have? those of us wanting properly run mailsystems use all technologies and methods to make the ecosystem sustainable, this includes engineering our own systems to prevent any avenue of abuse (such as emitting backscatter), we educate others by shunning those that emit abuse ala open-relay RBLs and how they eliminated the common and abusive practice of open relays, noways we track and shun those that emit backscatter by blocking <> from those known to emit it through simmilar RBLs. and the use of BATV
(not through blocking all <>)
same as we policy block mail from known spammers,known compromised systems, known open relays, and for many people systems known to not police their systems adequately to prevent their users forgeries.
(receiver system receivers rules, i side with the educators in my policies but my users can choose their own policy for their address')

>At the same time, spammers will be tempted to use the <> sender to save the trouble of
>making throwaway domains.

thats a truely dumb argument.
A no spammers currently do this, what they do is send the spam to a backscatter emitting system from<victim> to non-existant and rely on the backscatter emitting system to create and send the 'bounce-spam' backscatter from<> to <victim>
B no submission server (run well) accepts mail from <> thus no one can create a mail from <>
C no one in their right mind accepts direct to MX spam thus not accepting forged <> or forged <real-user>
D the issue for well run systems is finding and educating through shunning, spammers-run mailservers, backscatter emitters, badly setup submission servers (ones that allow senders to forge the from) which allow A,B or straight forged spam

>So spamfilters will block all attempts to use <>; thus bouncing will still be unusable.

anyone that does this is patently a moron (and thus deserves the issues rejecting bounces causes for their users never knowing their mail was undelivered)
if worried about forged <>
BATV is a simple and easily implemented way to reject forged bounces


>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120404031951:8F83D990-7E26-11E1-AEE1-D8D3A91823E1
>Powered by Listbox: http://www.listbox.com
Michael Deutschmann
2012-04-04 23:52:40 UTC
Permalink
On Wed, 4 Apr 2012, alan wrote:
> >that means that mailservers have to be prepared to accept
> >unbounceable mail.
>
> the opposite they should accept or reject at their edge, once the
> decision is made though they should not later change their minds.

They can reject *some* of the unbounceable mail at the edge. But even if
we optimistically assume that SPF-pass mail is bounceable, rejecting an
email (in-transaction, of course) *solely because* it is not bounceable is
a non-starter in 2012.

> what conspiracy??

The "Conspiracy Against Bounces". I call it that because it is a
substantial change in the ground rules of SMTP that was never codified in
an RFC. It's just a majority of admins on the ground deciding "We hate
backscatter, and we can fight it the same way we do direct spam.". The
fact that now any mail accepted at the edge must be delivered all the way
in (unless you break RFC and blackhole) was an accepted consequence.

Note that I support the CAB. So do you (quite enthusiastically!).

> if worried about forged <>
> BATV is a simple and easily implemented way to reject forged bounces

BATV is a kind of VERP, and VERP interacts poorly with whitelisting and
greylisting.

Lately I've been considering programming my mailserver to automatically
whitelist anyone I send to. But if the other guy uses VERP, the envelope
recipient I mail to is not the same as the envelope sender who will reply.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-05 00:27:20 UTC
Permalink
At 00:52 05/04/2012 Thursday, Michael Deutschmann wrote:
>On Wed, 4 Apr 2012, alan wrote:
>> >that means that mailservers have to be prepared to accept
>> >unbounceable mail.
>>
>> the opposite they should accept or reject at their edge, once the
>> decision is made though they should not later change their minds.
>
>They can reject *some* of the unbounceable mail at the edge. But even if
>we optimistically assume that SPF-pass mail is bounceable, rejecting an
>email (in-transaction, of course) *solely because* it is not bounceable is
>a non-starter in 2012.

you don't reject based on if its bounceable?? (as you never bounce any mail so its a non-factor)
also spf pass says nothing about the from address's validity (except in a few edge cases like me who have per user spf)

you reject based on, spammyness, sender reputation, local policy, content, spf-fail dkim-fail whatever ONLY

>> what conspiracy??
>
>The "Conspiracy Against Bounces". I call it that because it is a
>substantial change in the ground rules of SMTP that was never codified in
>an RFC. It's just a majority of admins on the ground deciding "We hate
>backscatter, and we can fight it the same way we do direct spam.". The
>fact that now any mail accepted at the edge must be delivered all the way
>in (unless you break RFC and blackhole) was an accepted consequence.

this is not recent thinking, this is more a reaction (backlash) against the increase in idiotic setups that emerged that did stuff like accept (spamfilter) then test if recipient-exists, and create bounce.
additionally the spam/av filters that didnt reject but bounced to the obviously forged from

so yes at some point we collectively decided no-more of this idiocy

>Note that I support the CAB. So do you (quite enthusiastically!).
>
>> if worried about forged <>
>> BATV is a simple and easily implemented way to reject forged bounces
>
>BATV is a kind of VERP, and VERP interacts poorly with whitelisting and
>greylisting.

there are ways round the whitelisting issues as long as your users are allowed to whitelist by ip+from: (from as opposed to envelope-from) (mail gets past rcpt by envelope-from domain being within one thats later from: whitelisted)
(as if they use batv the sending ip is quite predictable)

>Lately I've been considering programming my mailserver to automatically
>whitelist anyone I send to. But if the other guy uses VERP, the envelope
>recipient I mail to is not the same as the envelope sender who will reply.

simply whitelist the domain from RCPT-reject, if from:(in data) differs from whitelisted address then reject after data IF you would have otherwise rejected at RCPT

i find its a lost cause as most spam i see is from old friends accounts (long abandoned) now cracked/harvested and re-abused
so i whitelist few but by IP (trusted senders who are known non-emitters) or by from: when from otherwise untrustable fremailers (but only if received from validated sending ip's for those freemailers)
Michael Deutschmann
2012-04-05 04:42:41 UTC
Permalink
On Thu, 5 Apr 2012, alan wrote:
> you reject based on, spammyness, sender reputation, local policy,
> content, spf-fail dkim-fail whatever ONLY

Faced with an unbounceable incoming message about to cross the perimeter,
you try *really, really hard* to find a good reason to reject it. But you
often won't succeed, because a large proportion of *desired* mail has no
SPF information. (I see 72.9% year-to-date)

And of course that assumes it is reasonable to bounce SPF pass mail --
which if you'll remember, was what I questioned in my original post.

> this is not recent thinking, this is more a reaction (backlash)

Not in my experience. Before spam boomed in the turn of the millenium, it
was quite common for businesses to MX backup for each other, without
sharing valid address lists. That's a big backscatter magnet these days.

What changed was that some of those sloppy MXes started using "sender
verify with callout" (itself an abusive practice, but that's another
story) to protect themselves from deadletters piling up when they
accepted a spam with a completely made up envelope sender. That also
blocked the spammers from reaching users behind those MXes who actually
existed, so the spammers responded by using real addresses from their
"Millions CDs".

> simply whitelist the domain from RCPT-reject, if from:(in data) differs
> from whitelisted address then reject after data IF you would have
> otherwise rejected at RCPT

Looking at the RFC822 From: is a big can of worms. You have to let the
connection go to DATA, and work out how you'll deal with multi-RCPT mails.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-05 11:56:25 UTC
Permalink
At 05:42 05/04/2012 Thursday, Michael Deutschmann wrote:
>On Thu, 5 Apr 2012, alan wrote:
>> you reject based on, spammyness, sender reputation, local policy,
>> content, spf-fail dkim-fail whatever ONLY
>
>Faced with an unbounceable incoming message about to cross the perimeter,

ok firstly "unbouncable"? i assume you mean "possibly non-existant address" as there is no way to determine this

>you try *really, really hard* to find a good reason to reject it.

yes

> But you often won't succeed, because a large proportion of *desired* mail has no
>SPF information. (I see 72.9% year-to-date)

spf is only a tiny tiny factor in the accept/reject decision making process, more important is
IP>PTR>IP, helo parent domain=ptr parent domain, helo>ip, helo spf pass, helo csv pass, IP being on numerous blacklists, IP being on numerous whitelists, number of rcpt address's that failed, does the envelope-sender have an mx, does the envelope sender only have a A, then spamassasin score on data, whitelist/blacklist URLs in data, whitelist/blacklist From: in data, DKIM pass/fail, etc. etc.

>And of course that assumes it is reasonable to bounce SPF pass mail --
>which if you'll remember, was what I questioned in my original post.

again rejecting any mail is acceptable, bouncing (which is accepting and then later returning it to sender) is not ever acceptable, thus SPF isn't a factor in bounce/do not bounce decision, as bounce is never a valid option.

(simply put receivers should never generate bounces, senders (who can react to the "dead letters" by checking who submitted the forged mail and tightening their own controls on "their" inputs (the cause of the issue) can/should/do generate bounces ONLY)

>> this is not recent thinking, this is more a reaction (backlash)
>
>Not in my experience. Before spam boomed in the turn of the millenium, it
>was quite common for businesses to MX backup for each other, without
>sharing valid address lists. That's a big backscatter magnet these days.

maybe back in the days when all ran open relays (thus you could make any of these a backup MX for yourself with/without permission simply by adding their servers to your MXs)

I will admit this may be before my time

>What changed was that some of those sloppy MXes started using "sender
>verify with callout" (itself an abusive practice, but that's another
>story) to protect themselves from deadletters piling up when they
>accepted a spam with a completely made up envelope sender.

no one used it as deadletter protection, (yes i drank that kool-aid for a while i was young/naive), all used it on the assumption that 90% of spam is forged a good 50% of that is non-existant thus early way to dump 50% without content checking

> That also blocked the spammers from reaching users behind those MXes who actually
>existed, so the spammers responded by using real addresses from their
>"Millions CDs".

many used real forged address' even before sender-callout-verification, did this, most often viri would use the machines local address book and pick both from and to from same (based on the increased chance that they might know/trust one another and thus run the attachment)
but yes forged but existant envelope-sender was the beginning of the backscatter issue, firstly AV systems sending "notifiys/bounces" to the joe-jobbed address', later spammers doing bounce-spam* (just to clean the reputation of their IP)
(bounce-spam* == find a exchange box (little protection, default policy of accept all, then bounce (to stop address harvesting via which 5xx and which dont they claim) then send spam from victim to known non-existant address, let the bad reciever create the bounce and send it to the victim (payload intact) from a good reputation IP

as people realised bounce-spam was as bad as open-relay if not worse (and started being blacklisted for both)
they re configured their exchanges to do reject at RCPT time.
then spammers started looking for alternatives and found the few complex multi-stage multi-policy relays to continue.

backscatter is admittedly only an issue because the sheer volume of invalid vs valid mail is staggering, 99% of connections here result in a reject at some point. vs the 1% that get accepted (and a good many are still spam)

but it is our job as good netizens to ensure we are not part of the issue and do not allow our systems to cause grief to others so once you have identified receiver side bounces are always an issue, you eliminate them.

this causes, a dramatic downscaling of bounces
(as 60% of the connections inbound are from ratware (direct from infected pc to MX, thus no bounce generated (as the ratware knows it forged the address in envelope-from))
so thats 60% of bounce traffic gone immediatly
then of the 40% thats left it is up to the sender to generate a bounce to the user
(many of those will be ESPs and mailing-list-srvs and thus no-bounce just unsubscribes)
leaving 2 groups,
well run senders who return the bounce/NDR to the validated user who appreciates the information about the undeliverable message
badly run senders who allow their users to forge envelope-from who will generate backscatter to innocent 3rd parties, who will in turn have "dead letter" queues , be complained to, be RBL'd and shunned/educated, till they hopefully eventually clean up their policys

this is the desired outcome at least, the issue is a sender side one, as receivers we should ensure that it remains a sender issue and not obscure or amplify the issue by generating our own NDRs to 3rd parties

and again SPF is simply a non-factor in any receiver generated NDR scenario as we should never generate them
(that said NDRs are generated if an "internal" mailbox server is down for extended period, but this is a vanishing small non statistically relevant number, and becoming less, but it is the one case where a well setup receiver can cause an issue for a forged from)

>> simply whitelist the domain from RCPT-reject, if from:(in data) differs
>> from whitelisted address then reject after data IF you would have
>> otherwise rejected at RCPT
>
>Looking at the RFC822 From: is a big can of worms. You have to let the
>connection go to DATA, and work out how you'll deal with multi-RCPT mails.

multi rcpt mails are easy, i accept the first(valid) one (that passes the users spec thus far)
then defer(4xx) all others that would have passed but have different post data specs
thus post data accept/reject dosn't affect the other recipients still queued on the sender side

you have to let the connection go to data for DKIM, spamassasin, av scanning etc etc too,
dealing with multi RCPT mails has been no issue for any of those.
Michael Deutschmann
2012-04-06 02:42:09 UTC
Permalink
On Thu, 5 Apr 2012, alan wrote:
> ok firstly "unbouncable"? i assume you mean "possibly non-existant
> address" as there is no way to determine this

No, more like "possibly forged addresses".

Specifically, if it is dangerous for you to neither violate the RFCs nor
deliver it forwards, then it's unbounceable. (One quirk of this
defintion is that <> is not as unbounceable as a random no-SPF-record mail
address, as the RFCs say not to try...)

Bouncing to a real but forged and non-SPF-validated address probably won't
result in a deadletter. But it's still dangerous because it will get
people ticked off and sending their antispam gurus to contain you.

The only mails that are bouceable in 2012 are SPF-pass mails (maybe...),
and mails that bear putative sender addresses that are within your own
bailiwick.

> > But you often won't succeed, because a large proportion of *desired*
> > mail has no SPF information. (I see 72.9% year-to-date)
> spf is only a tiny tiny factor in the accept/reject decision

I don't mean "lack of SPF information causes you to fail to identify the
message as bad in time to reject it in-transaction". I meant:

Lots of mail will pass all reasonable spam tests, because it actually
isn't spam. And a bit more spam will squeak through in practice. But most
of this stream has no SPF information, so mail in this stream can neither
be rejected in-transaction nor be rejected via bounce.

> maybe back in the days when all ran open relays (thus you could make
> any of these a backup MX for yourself with/without permission simply by
> adding their servers to your MXs)

Open relays were common then, although the practice was already regarded
as a great offence.

Back in 2001, I was acting as an unofficial advisor to my own ISP on spam
issues. The admin there asked me about the safety of deploying sender
verify on Exim, in order to reduce a flood of deadletters that was
annoying him. (Note: this was oridinary sender verify, where just the
existence of an MX is checked -- not the abusive callout feature.)

I advised him that there was no danger in doing so, but that the
deadletters were just part of an underlying problem that would not be
fixed by the measure.

So he was running a system that was a backscatter hazard by today's
standards, and didn't care very much except where (via deadletters) the
problem impacted him.

> you have to let the connection go to data for DKIM, spamassasin, av
> scanning etc etc too, dealing with multi RCPT mails has been no issue
> for any of those.

But letting everything go to DATA in hopes that a content analyser will
"rescue" a mail where the RCPT-level checks give a negative vote is
rather radical.

---- Michael Deutschmann <***@talamasca.ocis.net>
Sanford Whiteman
2012-04-06 02:51:30 UTC
Permalink
> Back in 2001, I was acting as an unofficial advisor to my own ISP on spam
> issues. The admin there asked me about the safety of deploying sender
> verify on Exim, in order to reduce a flood of deadletters that was
> annoying him. (Note: this was oridinary sender verify, where just the
> existence of an MX is checked -- not the abusive callout feature.)

As late as 2007, I was helping experienced antispam providers get
scheduled address list dumps from Exchange and other mailbox servers
up to the edge (via FTP). I wouldn't call it state-of-the-art for that
time, exactly. But there were def'ly a wide swath of people who were
great at catching spam, but who couldn't prioritize/mandate the
address list sync because it required help from the clients, many of
whom were small businesses with no knowledge of how to set up a
scheduled upload, etc., and others large businesses who took their
sweet time setting up a Guest account to query LDAP and so on.

These things are all easier now, though it's still true that some
"intrusion" by the provider is necessary... and rightly so because the
address list should never be public queryable.

-- Sandy
alan
2012-04-06 04:31:25 UTC
Permalink
At 03:42 06/04/2012 Friday, Michael Deutschmann wrote:
>On Thu, 5 Apr 2012, alan wrote:
>> ok firstly "unbouncable"? i assume you mean "possibly non-existant
>> address" as there is no way to determine this
>
>No, more like "possibly forged addresses".

either way no possible way to determine this (except spf fail) all passes and neutrals are still possibly forged

>Specifically, if it is dangerous for you to neither violate the RFCs nor
>deliver it forwards, then it's unbounceable. (One quirk of this
>defintion is that <> is not as unbounceable as a random no-SPF-record mail
>address, as the RFCs say not to try...)

if you do not wish to deliver forwards you reject, there is no 'bounce'

>Bouncing to a real but forged and non-SPF-validated address probably won't
>result in a deadletter. But it's still dangerous because it will get
>people ticked off and sending their antispam gurus to contain you.

bouncing is never acceptable, reject or accept, there is no need to ever bounce
bouncing again is accepting and then rejecting afterwards

>The only mails that are bouceable in 2012 are SPF-pass mails (maybe...),
>and mails that bear putative sender addresses that are within your own
>bailiwick.

no mail is ever bounceable (receiver side) the idea of accept then bounce (instead of just rejecting during transaction is pure stupidity)

>> > But you often won't succeed, because a large proportion of *desired*
>> > mail has no SPF information. (I see 72.9% year-to-date)
>> spf is only a tiny tiny factor in the accept/reject decision
>
>I don't mean "lack of SPF information causes you to fail to identify the
>message as bad in time to reject it in-transaction". I meant:
>
>Lots of mail will pass all reasonable spam tests, because it actually
>isn't spam. And a bit more spam will squeak through in practice. But most
>of this stream has no SPF information, so mail in this stream can neither
>be rejected in-transaction nor be rejected via bounce.

all mail you wish to reject in transaction is rejectable (spf or not)
the only person who could suffer is the sender (who may backscatter the forged users in response)
and they should suffer, and through the blacklisting they receive either cleanup or get out
either way their problem isn't your issue, and has zero effect on your reputation

>> maybe back in the days when all ran open relays (thus you could make
>> any of these a backup MX for yourself with/without permission simply by
>> adding their servers to your MXs)
>
>Open relays were common then, although the practice was already regarded
>as a great offence.
>
>Back in 2001, I was acting as an unofficial advisor to my own ISP on spam
>issues. The admin there asked me about the safety of deploying sender
>verify on Exim, in order to reduce a flood of deadletters that was
>annoying him. (Note: this was oridinary sender verify, where just the
>existence of an MX is checked -- not the abusive callout feature.)
>
>I advised him that there was no danger in doing so, but that the
>deadletters were just part of an underlying problem that would not be
>fixed by the measure.
>
>So he was running a system that was a backscatter hazard by today's
>standards, and didn't care very much except where (via deadletters) the
>problem impacted him.
>
>> you have to let the connection go to data for DKIM, spamassasin, av
>> scanning etc etc too, dealing with multi RCPT mails has been no issue
>> for any of those.
>
>But letting everything go to DATA in hopes that a content analyser will
>"rescue" a mail where the RCPT-level checks give a negative vote is
>rather radical.

it only goes to data for users who use sender whitelists for batv senders
and only if mail-from-domain == one of the batv whitelisted domains
(few and far between, 3 users on my systems whitelist batv using senders, and a .many-zeros1 percent of mail)

I never suggested going to data to rescue from rcpt level fail (and never would)
connection/helo/mail-from/rcpt level fails 5xx at rcpt
rcpt level passes still have to pass possible data level checks
and if userA counts a spamassasin fail at score 5 and userB uses 6
then as i explained a mail sent to both passing rcpt level checks for both (as both can set these seperatly too)
would get a success for first recipient and a 4xx on second
so userA gets his data check on first try and rejects after data if score 5 or above
userB is the only recipient of the retry and rejects after data if a score 6 or above


>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120405224216:1DD7E878-7F92-11E1-A647-8BF664F78E3D
>Powered by Listbox: http://www.listbox.com
Michael Deutschmann
2012-04-06 07:35:45 UTC
Permalink
On Fri, 6 Apr 2012, alan wrote:
> either way no possible way to determine this (except spf fail) all
> passes and neutrals are still possibly forged

SPF-neutral is indeed unbounceable. But if an SPF-pass mail is forged,
it's the sender domain's own fault. They signed off and should have known
better.

If they want to disclaim responsibility for a portion of the mailstream
putatively from themselves, yet want to plead with people to accept it
anyway, that's what SPF-neutral is for.

Configuring a smarthost to prevent end-users from using identities that
they do not own (but that the same smarthost is indeed responsible for),
is a far easier problem than arranging bounce-free handling of incoming
mail.

> (few and far between, 3 users on my systems whitelist batv using
> senders, and a .many-zeros1 percent of mail)
So it doesn't scale to *automated* whitelisting and greylisting.

Note that if the user actually tells you, "I want to whitelist
<***@example.net>, and I *know* they are using the BATV family of
VERP", then you can add example.net to a local list of domains for which
you can demangle the VERP before consulting the whitelist and greylist.

But to do that without specific hints from the end-users, I'd want some
kind of signal, such as a modifier in the VERPing domain's own SPF record,
that tells me how to derive a whitelist key from the envelope sender.

For BATV the algorithm would appear to be discarding a prefix up to and
including the first two '=' characters from the localpart, but non-BATV
domains might use '=' in other ways. BATV isn't even an RFC, so the
standing orders are that localparts must be assumed opaque.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-06 13:20:29 UTC
Permalink
At 08:35 06/04/2012 Friday, Michael Deutschmann wrote:
>On Fri, 6 Apr 2012, alan wrote:
>> either way no possible way to determine this (except spf fail) all
>> passes and neutrals are still possibly forged
>
>SPF-neutral is indeed unbounceable.

?? no mail is legitimatly bounceable, accept or reject there is no need to ever accept and later bounce

> But if an SPF-pass mail is forged,
>it's the sender domain's own fault. They signed off and should have known
>better.

the user sending from envelope from ***@correct.domain is both likely and common
do-not-***@xxxx is painfully common, which is why you reject (leaving the dead letter issue with the sender) or accept, but never bounce

>If they want to disclaim responsibility for a portion of the mailstream
>putatively from themselves, yet want to plead with people to accept it
>anyway, that's what SPF-neutral is for.

spf (generally) makes no claim as to the existance /non existance of the mailbox, just the authorised/non authorised status of the sending ip (for the domain)

>Configuring a smarthost to prevent end-users from using identities that
>they do not own (but that the same smarthost is indeed responsible for),
>is a far easier problem than arranging bounce-free handling of incoming
>mail.

not really, we do both, and i can tell you the submission server is way more work to setup and maintain, but its work thats both necessary and prudent to ensure our users do not become other peoples abusers

>> (few and far between, 3 users on my systems whitelist batv using
>> senders, and a .many-zeros1 percent of mail)
>So it doesn't scale to *automated* whitelisting and greylisting.
>
>Note that if the user actually tells you, "I want to whitelist
><***@example.net>, and I *know* they are using the BATV family of
>VERP", then you can add example.net to a local list of domains for which
>you can demangle the VERP before consulting the whitelist and greylist.

the user does this they whitelist ***@y at rcpt
the system informs them that ***@y has never had a rejection/acceptance (they usually don't read the docs) so call me to complain
i suggest that as we have seen a/b/c/d/***@y maybe the far end is using batv we look they are and they re-add ***@y to their from: whitelist
or in many cases they whitelist *@y in rcpt as they doubt bob has any spammers working in the same company/domain

you see our users have no reason to whitelist by envelope-from in most cases as
A its easily forged, B its easier to find why it was rejected and whitelist that ip/domain for that error

if mail from ***@example gets rejected cos bobs server greets with made-up_hostname.local then its easier for that user to add that ip/name to his whitelist of invalid but accepted by him helo's
or if bobs ip gets regularly in some rbl, whitelist that ip from rblchecks when sending to you user

all whitelists are per user so a users dumb whitelisting effects no one but themselves
(all users control their own policy most become adept at referring the sender to the rejection reason and insisting they fix it so they can use more draconian filters on their own address, rather than dealing with whitelisting dodgy senders)

the fact that ***@example uses batv becomes a non-issue
(actually few batv senders have ever had any cause for whitelisting, as few have any issues with ip-reputation,helo,spf dkim or anything else)

>But to do that without specific hints from the end-users, I'd want some
>kind of signal, such as a modifier in the VERPing domain's own SPF record,
>that tells me how to derive a whitelist key from the envelope sender.

not in any way SPFs job, if you want batv domains to self identify then you have to use another protocol, go off write one

>For BATV the algorithm would appear to be discarding a prefix up to and
>including the first two '=' characters from the localpart, but non-BATV
>domains might use '=' in other ways. BATV isn't even an RFC, so the
>standing orders are that localparts must be assumed opaque.

batv and verp are both usually handleable via whitelisting by regexp on localpart, the regexp in question differs each time, if the user cant figure it they call me, but its not usually necessary and so far 0 users have needed to setup any as they just whitelist the ip(s) from whatever check the mail failed


>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120406033552:2180CD86-7FBB-11E1-B22B-D03858600CB5
>Powered by Listbox: http://www.listbox.com
Stuart D Gathman
2012-04-21 03:24:01 UTC
Permalink
Long ago, Nostradamus foresaw that on 04/05/2012 07:56 AM, alan would
write:
>
> again rejecting any mail is acceptable, bouncing (which is accepting and then later returning it to sender) is not ever acceptable, thus SPF isn't a factor in bounce/do not bounce decision, as bounce is never a valid option.
>
> (simply put receivers should never generate bounces, senders (who can react to the "dead letters" by checking who submitted the forged mail and tightening their own controls on "their" inputs (the cause of the issue) can/should/do generate bounces ONLY)
>
I have no trouble with backscatter, because I "sign" MFROM for outgoing
mail, and forged bounces are rejected at RCPT TO. This also plays
nicely with Call back validation, since forged emails will not have a
valid MFROM. It doesn't play as nicely with greylisting, but works ok
as long as signatures don't change too often for a given user.
alan
2012-04-04 00:48:33 UTC
Permalink
At 20:36 03/04/2012 Tuesday, Michael Deutschmann wrote:
>Recently I've been pondering one simple question:
>
> "Is it okay, on the modern internet, to send a bounce message outside
> of one's own bailiwick, when the original message had an SPF Pass
> result?"
>
>Without an SPF pass, the consensus is clear -- bouncing is unacceptable
>because it risks backscatter. (So all mail accepted by an MX must be
>delivered all the way forwards, explicitly ignoring any local policy
>preference to the contrary.)

i would argue
you cannot have any difference in acceptance policy between your own mx's (including any hidden internal hops)
if you do you have a bigger issue than backscatter.
All rejection decisions MUST be made on the edge.
thus any mail accepted by any of your MX's will therefore obviously reach the user or their spamfolder
(blackholing should simply never be done)
(having further deeper analysis of the content on an internal/downstream host for scoring/filtering is fine, but if you are rejecting it must be at the first MX contacted)

the only bounces your hosts should ever generate are ones to your users in response to 5xx rejects from remote servers they attempted to send to.

this simple rule ensures you can never be a source of backscatter as you never bounce any mail.

if using a 3rd party to provide backup mx they must have identical policy (which most cannot) so you MUST
A never use a 3rd party that dosn't have a synched copy of your live addresses
B pick one with a policy you can live with and ensure that all mail from them is whitelisted (except for scoring/filtering to spamfolder) they should never see a 5xx
C live with the fact that if you have a difference in policy between MX's spammers will simply ALL only deliver to the most relaxed MX, (they get paid per 2xx, not by how many reach the user) so if you don't 5xx initially they have won(monitarilly)

so having a backup mx with a 3rd party means your own policy becomes pointless/futile

alternately (and what I recommend to all our customers) if your own MX's arn't reliable enough then ditch them entirely
setup your MX's to point ONLY at reliable 3rd party, ensure their policy is setup as you wish, let them deliver to you ONLY (access lists firewall rules whatever) but only accept SMTP from their servers and never 5xx
points A and B above still are applicable in this scenario

(info: we do provide spamfiltering/reliable MX's for customers but do not allow them to accept smtp directly if we do, we also insist their outbound stream is directed via us also (for us to ensusure they cant send with non-existant return path etc.) also we insist they 5xx unknown users at their edge (some exchange servers don't by default so we show them howto) and we use smtp callforward to sync our address-lists live with theirs, any 5xx response from them other than user unknown is an immediate investigation and firing if they are bouncing/rejecting due to content as we will not allow them to make us send backscatter, and we will not allow them to send out backscatter directly or via us. we also will not allow them to send anything phishy or spammy or forged, obviously.
we're quite proud of the fact that we allow them to set per domain defaults and per address exceptions (stricter or looser) on all areas of filtering/scoring/rejecting policy so that hopefully we provide a more robust and customisable solution than they could ever have in-house, but do encourage them to do further content filtering in-house if and only if it results in a spamfoldering not a blackhole or bounce)

>Until recently, my answer to the question was "Yes. Although it hasn't
>come up in practice yet, so the ground may not be firm...", as
>backscatter is impossible with an SPF Pass based on a sane SPF record.
>(If the SPF record is insane, it's the backscatter victim's own fault.)
>However, lately I'm starting to doubt it.
>
>The problem is this: The original sender may be not only publishing his
>own SPF policy, but using SPF lookups in combination with a whitelist to
>decide whether to accept mail. Now, if the reputation of the bouncing
>site is not good enough for that sender to accept mail from someone not
>whitelisted, then they won't accept the bounce either, since bounces are
>sent from <>.
>
>So, the answer then is "No. Unlike the non-SPF case, you won't make
>anyone angry. But there's still a substantial risk of double-bounce,
>which you can avoid by remaining as cautious as if there were no SPF."
>
>On the other hand, there are lots of special cases where an SPF pass
>message could be bounced. If no sender-address whitelists are used, or
>they only serve to stand down content filters, a bounce is unlikely to
>fail. And VERP allows legitimate bounces to be recognized, at a cost of
>complicating whitelisting at the other site.
>
>There is a small incentive for a site to permit bouncing. A backup MX
>serving multiple domains might reserve a portion of it's queue space
>only for bounceable messages. Then, if a mailbomb occurs against a
>mailbox with a primary that is down, the server can continue to accept
>only Pass mail in hopes that the server will come back up, knowing that
>it *can* flush the queue buildup without operator attention if it has
>to. Unknown/Softfail/None mail would simply be deferred until the
>messages presently sitting in the queue can be unloaded forwards.
>
>So, it might be reasonable to add a modifier (to SPFv1), or a new
>qualifier (in SPFv3), that indicates "Pass, and I'll accept bounces in
>potential return of faster delivery."
>
>(Note that my Substitute Whitelist Key proposal from 2008 would have
>resolved this problem, as it would allow both for VERP/whitelist
>co-existance and for the failed-sender of a bounce to be indicated to
>the SMTP server in the MAIL command.)
>
>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120403153709:616DEB34-7DC4-11E1-959A-EFE378D6CBD4
>Powered by Listbox: http://www.listbox.com
G.W. Haywood
2012-04-06 10:45:50 UTC
Permalink
Hi there,

On Tue, 3 Apr 2012, Michael Deutschmann wrote:

> Recently I've been pondering one simple question:
>
> "Is it okay, on the modern internet, to send a bounce message outside
> of one's own bailiwick, when the original message had an SPF Pass
> result?"

One simple answer. No.

I really can't see why the thread has trundled on for so long.

Incidentally I see more spammers (far more, both in absolute terms and
as a proportion) than genuine mail senders using SPF, and the senders
of genuine mail screw up their SPF records far more often and in more
imaginative ways than the spammers do. It almost drives me to despair.

--

73,
Ged.
alan
2012-04-06 13:25:26 UTC
Permalink
At 11:45 06/04/2012 Friday, G.W. Haywood wrote:
>Hi there,
>
>On Tue, 3 Apr 2012, Michael Deutschmann wrote:
>
>>Recently I've been pondering one simple question:
>>
>>"Is it okay, on the modern internet, to send a bounce message outside
>> of one's own bailiwick, when the original message had an SPF Pass
>> result?"
>
>One simple answer. No.
>
>I really can't see why the thread has trundled on for so long.
>
>Incidentally I see more spammers (far more, both in absolute terms and
>as a proportion) than genuine mail senders using SPF, and the senders
>of genuine mail screw up their SPF records far more often and in more
>imaginative ways than the spammers do. It almost drives me to despair.

+1
ips whitlisted against SPF fail are the most numerous whitlists any of our users have
(most are non srs forwarders, non-rewriting mailinglist exploders etc)
Murray S. Kucherawy
2012-04-06 14:12:48 UTC
Permalink
> -----Original Message-----
> From: G.W. Haywood [mailto:***@jubileegroup.co.uk]
> Sent: Friday, April 06, 2012 3:46 AM
> To: SPF discuss
> Subject: Re: [spf-discuss] SPF and bouncing
>
> > "Is it okay, on the modern internet, to send a bounce message outside
> > of one's own bailiwick, when the original message had an SPF Pass
> > result?"
>
> One simple answer. No.
>
> I really can't see why the thread has trundled on for so long.

Sure it is. Anyone can reject a message for any of a variety of policy reasons regardless of what SPF says.

The problem to me is the ambiguity of the question.

> Incidentally I see more spammers (far more, both in absolute terms and
> as a proportion) than genuine mail senders using SPF, and the senders
> of genuine mail screw up their SPF records far more often and in more
> imaginative ways than the spammers do. It almost drives me to despair.

For the work of the spfbis working group at IETF, I just ran a survey of over a quarter million domains' SPF records. Some of the errors are indeed quite creative, not to mention the junk a parser has to deal with along the way. For example, do a TXT query for any of these:

B93radio.com
Wncy.com
Wtaq.com
Dealdirectsendz.info
Ut.edu
Aaronline.com
Dwgsecurity.com
Emergogroup.com
Banctec.com
Warwick.ac.uk

Those are just my top ten by record count.

-MSK
Michael Deutschmann
2012-04-07 04:21:58 UTC
Permalink
On Fri, 6 Apr 2012, G.W. Haywood wrote:
> On Tue, 3 Apr 2012, Michael Deutschmann wrote:
> > "Is it okay, on the modern internet, to send a bounce message outside
> > of one's own bailiwick, when the original message had an SPF Pass
> > result?"
>
> One simple answer. No.

How about this variation:

"Is it okay, on the modern internet, to assume that legitimate bounce
messages between bailiwicks will not occur?"

That is, to declare that deadletters other people experience when they try
to bounce something you *actually sent* are their own fault for not
saluting the Conspiracy Against Bouncing.

I'm suprised how vehement people are behind the No regarding the first
question, but that may just be Postel's Law talking. ("Be conservative in
what you send, liberal in what you accept.") Postel would also say No to
the second one.

And on reflection, it's the second question that is most important. Some
anti-spam strategies become far weaker if asked to treat a bounce message
for failed delivery to <***@y> just as well as a normal message from <***@y>.

Most dramatically, this applies to goldlisting, where any envelope sender
not on the whitelist is rejected. If <> is not whitelisted, no bounce ever
gets through. If <> is, anyone from any IP can circumvent the goldlist.

(One idea is to use SPF-checked HELO and/or rDNS to at least get a domain
that can be coarsely checked against the whitelist. But that can easily
fail, especially if the sending IP is a smarthost for many domains.)

---- Michael Deutschmann <***@talamasca.ocis.net>
Alessandro Vesely
2012-04-07 11:48:50 UTC
Permalink
On Sat 07/Apr/2012 13:36:48 +0200 Michael Deutschmann wrote:
>
> "Is it okay, on the modern internet, to assume that legitimate bounce
> messages between bailiwicks will not occur?"

I'd say no, because of the better-cause-deserving diligence that some
organizations put in making sure that the envelope sender is kept
unaltered on forwarding to external mailboxes. That policy is
supported by "alias expansion" as standardized by SMTP.

> (One idea is to use SPF-checked HELO and/or rDNS to at least get a domain
> that can be coarsely checked against the whitelist. But that can easily
> fail, especially if the sending IP is a smarthost for many domains.)

IMHO it makes sense to require that such kind of forwarders have at
least a good helo identity, I mean accompanied by an SPF record. Then
checkers must not reject if they have malfrom->fail and helo->pass.
Michael Deutschmann
2012-04-07 14:05:55 UTC
Permalink
On Sat, 7 Apr 2012, Alessandro Vesely wrote:
> I'd say no, because of the better-cause-deserving diligence that some
> organizations put in making sure that the envelope sender is kept
> unaltered on forwarding to external mailboxes. That policy is
> supported by "alias expansion" as standardized by SMTP.

We aren't discussing forwarders, but ordinary SMTP with only one hop
across the border.

Although the conspiracy is quite relevant to forwarders. It destroys
them and is even harsher on SRS forwarders than legacy forwarders.

The only sustainable hope for a forwarder is a side deal with the admins
of the ultimate recipient server to obtain the same super-whitelisting
(overriding even mailbox diskspace quota and immune to automated
blacklisting) that backup MXes have. Then it really doesn't matter what
the MAIL FROM: is.

I hear some forwarders are actually considering the hack of beginning the
outgoing transaction simultaneously with the incoming one, so that it
doesn't respond to the sender->forwarder CR LF '.' CR LF until it has the
response from the forwarder->recipient transaction. That would be
conspiracy-compliant but explicitly not RFC-compliant (RFC 1047, RFC 1123
section 5.3.3).

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-07 15:27:46 UTC
Permalink
again i recommend taking this offlist to the email i supplied, without your permission I'm not going to direct mail you

At 15:05 07/04/2012 Saturday, Michael Deutschmann wrote:
>On Sat, 7 Apr 2012, Alessandro Vesely wrote:
>> I'd say no, because of the better-cause-deserving diligence that some
>> organizations put in making sure that the envelope sender is kept
>> unaltered on forwarding to external mailboxes. That policy is
>> supported by "alias expansion" as standardized by SMTP.
>
>We aren't discussing forwarders, but ordinary SMTP with only one hop
>across the border.
>
>Although the conspiracy is quite relevant to forwarders. It destroys
>them and is even harsher on SRS forwarders than legacy forwarders.

err? what no it isn't forwarders (especially srs forwarders) are pretty much immune to backscatter complaints
(unless the end user dosn't have them exempted from content filter rejection in which case they should (as we do) fire the customer if he won't/can't.
we/they (and anyone else who provides srs forwarding for users) shouldn't have to destroy our reputation because a user wants to set the filtering our side to be more lax than on his side, he should filter at our reception no-where else.
as a forwarder will never have a non-existant mailbox as a recipient.

>The only sustainable hope for a forwarder is a side deal with the admins
>of the ultimate recipient server to obtain the same super-whitelisting
>(overriding even mailbox diskspace quota and immune to automated
>blacklisting) that backup MXes have. Then it really doesn't matter what
>the MAIL FROM: is.

ok this is the one time bounces MAY legitimately occur (disk quotas)
but unless the user side is abandoned or badly run it shouldn't be persistent or even a common enough occurrence to cause trouble (also sys-admins are supposed to be aware of these issues to lart/delete the user before these issues happen)
(as far as I am aware no backscatter RBLs consider mailbox full as a listing offence even if to innocent 3rd party due to this)
a well setup forwarder or frontline MX will cache 5xx and 2xx responses for period (thus a 5xx from overquota) will result in 1 bounce every period ONLY) obviously it also extends the period the forwarder or frontline MX rejects incoming mail beyond the time the user has resolved the issue, in our case 15mins as we see most users pickup their mail at this interval.

>I hear some forwarders are actually considering the hack of beginning the
>outgoing transaction simultaneously with the incoming one, so that it
>doesn't respond to the sender->forwarder CR LF '.' CR LF until it has the
>response from the forwarder->recipient transaction. That would be
>conspiracy-compliant but explicitly not RFC-compliant (RFC 1047, RFC 1123
>section 5.3.3).

I think you might be talking rcpt callout verification, which yes our forwarders and forward MX's do
(it breaks no rfc's it simply (when cache expires an next mail arrives) causes at rcpt time a connection helo>mail from: sender>rcpt to: reciever>quit, and if the response in 2xx caches it and accepts the message if response is 4xx or 5xx caches the entire line and responds to the sender with this till the next cache expiry.
Alessandro Vesely
2012-04-08 10:01:34 UTC
Permalink
On Sun 08/Apr/2012 11:36:31 +0200 alan wrote:
> At 15:05 07/04/2012 Saturday, Michael Deutschmann wrote:
>>
>> We aren't discussing forwarders, but ordinary SMTP with only one
>> hop across the border.

I like how SPF works in those cases.

>> The only sustainable hope for a forwarder is a side deal with the
>> admins of the ultimate recipient server to obtain the same
>> super-whitelisting (overriding even mailbox diskspace quota and
>> immune to automated blacklisting) that backup MXes have. Then it
>> really doesn't matter what the MAIL FROM: is.

What about "generic" forwarders? I mean sites who provide a web-form
to let users specify whatever address they like. They are obviously
not going to hound ultimate servers' admins in order to have their
site whitelisted. BTW, most target domains are gmail, yahoo, and the
like, so such whitelisting is probably tantamount a whitelist of all
legitimate mail servers, which is probably what those huge mailbox
providers are doing anyway.

Small to normally large mail sites cannot be reliable forwarding
targets if they reject when an smtp.mailfrom results in a fail.
So, I think it would be fair to require to also check smtp.helo in
such cases, and accept the message if the it results in a pass. What
do you think?

> ok this is the one time bounces MAY legitimately occur (disk
> quotas) but unless the user side is abandoned or badly run it
> shouldn't be persistent or even a common enough occurrence to cause
> trouble (also sys-admins are supposed to be aware of these issues
> to lart/delete the user before these issues happen) (as far as I am
> aware no backscatter RBLs consider mailbox full as a listing
> offence even if to innocent 3rd party due to this) a well setup
> forwarder or frontline MX will cache 5xx and 2xx responses for
> period (thus a 5xx from overquota) will result in 1 bounce every
> period ONLY) obviously it also extends the period the forwarder or
> frontline MX rejects incoming mail beyond the time the user has
> resolved the issue, in our case 15mins as we see most users pickup
> their mail at this interval.

After a given number of bounces, the forwarding could well be removed.
That's the approach mailing lists do, and provides for automatically
removing stale addresses. Are there implementations doing so?
alan
2012-04-08 19:50:12 UTC
Permalink
At 11:01 08/04/2012 Sunday, Alessandro Vesely wrote:
>On Sun 08/Apr/2012 11:36:31 +0200 alan wrote:
>> At 15:05 07/04/2012 Saturday, Michael Deutschmann wrote:
>>>
>>> We aren't discussing forwarders, but ordinary SMTP with only one
>>> hop across the border.
>
>I like how SPF works in those cases.
>
>>> The only sustainable hope for a forwarder is a side deal with the
>>> admins of the ultimate recipient server to obtain the same
>>> super-whitelisting (overriding even mailbox diskspace quota and
>>> immune to automated blacklisting) that backup MXes have. Then it
>>> really doesn't matter what the MAIL FROM: is.
>
>What about "generic" forwarders? I mean sites who provide a web-form
>to let users specify whatever address they like. They are obviously
>not going to hound ultimate servers' admins in order to have their
>site whitelisted. BTW, most target domains are gmail, yahoo, and the
>like, so such whitelisting is probably tantamount a whitelist of all
>legitimate mail servers, which is probably what those huge mailbox
>providers are doing anyway.

we do the web form provision, we set envelope sender to account-***@our-domain
(so sfp pass)
and bounces to this are re-written to the owner of the site
site owners who use hotmail or gmail are required to setup their hotmail/gmail to pickup their mail by pop3 rather than have us forward it to them

>Small to normally large mail sites cannot be reliable forwarding
>targets if they reject when an smtp.mailfrom results in a fail.
>So, I think it would be fair to require to also check smtp.helo in
>such cases, and accept the message if the it results in a pass. What
>do you think?

most site owners on small sites have the ability to just whitelist their webservers (our servers) sending ip, those that arnt able to usually have to setup some sort of pop3 pickup if their mailsystem dosnt allow reliable forwarding

>> ok this is the one time bounces MAY legitimately occur (disk
>> quotas) but unless the user side is abandoned or badly run it
>> shouldn't be persistent or even a common enough occurrence to cause
>> trouble (also sys-admins are supposed to be aware of these issues
>> to lart/delete the user before these issues happen) (as far as I am
>> aware no backscatter RBLs consider mailbox full as a listing
>> offence even if to innocent 3rd party due to this) a well setup
>> forwarder or frontline MX will cache 5xx and 2xx responses for
>> period (thus a 5xx from overquota) will result in 1 bounce every
>> period ONLY) obviously it also extends the period the forwarder or
>> frontline MX rejects incoming mail beyond the time the user has
>> resolved the issue, in our case 15mins as we see most users pickup
>> their mail at this interval.
>
>After a given number of bounces, the forwarding could well be removed.
>That's the approach mailing lists do, and provides for automatically
>removing stale addresses. Are there implementations doing so?

well ours dosn't auto remove we rely on the admin being awake (but they are)
so they notice when it happens and call/im/txt the end user but if no response to extended mailbox full we will just manually disable the incomming address 5xx
Alessandro Vesely
2012-04-09 09:21:54 UTC
Permalink
On Mon 09/Apr/2012 11:07:16 +0200 alan wrote:
> At 11:01 08/04/2012 Sunday, Alessandro Vesely wrote:
>>
>> What about "generic" forwarders? I mean sites who provide a web-form
>> to let users specify whatever address they like. They are obviously
>> not going to hound ultimate servers' admins in order to have their
>> site whitelisted. BTW, most target domains are gmail, yahoo, and the
>> like, so such whitelisting is probably tantamount a whitelist of all
>> legitimate mail servers, which is probably what those huge mailbox
>> providers are doing anyway.
>
> we do the web form provision, we set envelope sender to
> account-***@our-domain (so sfp pass) and bounces to this are
> re-written to the owner of the site site owners who use hotmail or
> gmail are required to setup their hotmail/gmail to pickup their
> mail by pop3 rather than have us forward it to them

That's the most sensible way to do it, IMHO. From a legal POV, it
enables the forwarder to keep a target address undisclosed, if its
owner so wishes. Bounces going back directly to the original sender
would break such privacy constraint.

However, I reckon a minority of mail sites do forwarding that way.
Or is that a feature of my Internet's local group?

>> Small to normally large mail sites cannot be reliable forwarding
>> targets if they reject when an smtp.mailfrom results in a fail.
>> So, I think it would be fair to require to also check smtp.helo in
>> such cases, and accept the message if the it results in a pass. What
>> do you think?
>
> most site owners on small sites have the ability to just whitelist
> their webservers (our servers) sending ip, those that arnt able to
> usually have to setup some sort of pop3 pickup if their mailsystem
> dosnt allow reliable forwarding

You mean FBL subscriptions? That's the last bullet point in John
Levine's rough summary of forwarding:
http://www.circleid.com/posts/how_spam_has_damaged_mail_forwarding_and_ways_to_get_around_it/
alan
2012-04-09 11:46:03 UTC
Permalink
At 10:21 09/04/2012 Monday, Alessandro Vesely wrote:
>On Mon 09/Apr/2012 11:07:16 +0200 alan wrote:
>> At 11:01 08/04/2012 Sunday, Alessandro Vesely wrote:
>>>
>>> What about "generic" forwarders? I mean sites who provide a web-form
>>> to let users specify whatever address they like. They are obviously
>>> not going to hound ultimate servers' admins in order to have their
>>> site whitelisted. BTW, most target domains are gmail, yahoo, and the
>>> like, so such whitelisting is probably tantamount a whitelist of all
>>> legitimate mail servers, which is probably what those huge mailbox
>>> providers are doing anyway.
>>
>> we do the web form provision, we set envelope sender to
>> account-***@our-domain (so sfp pass) and bounces to this are
>> re-written to the owner of the site site owners who use hotmail or
>> gmail are required to setup their hotmail/gmail to pickup their
>> mail by pop3 rather than have us forward it to them
>
>That's the most sensible way to do it, IMHO. From a legal POV, it
>enables the forwarder to keep a target address undisclosed, if its
>owner so wishes. Bounces going back directly to the original sender
>would break such privacy constraint.

yeah and as webform forwarding the original sender can be forged, intentionally or typo (its just an entry in a form) so bouncing to that ever would be an avenue for abuse.

but I hadn't thought of the anonymity portion before i might just have to add some code to our SRS so that address's in the body of returned bounces get appropriately re-written (obviously these returned bounces being from mailbox full or server down) as other 5xx's cause the admin team to kill the forwarded address

>However, I reckon a minority of mail sites do forwarding that way.
>Or is that a feature of my Internet's local group?

i would say its a minority, as only a minority (in any field) tend to actively try and ensure at design stage that their systems attempt to honour 'do no harm' at every level

>>> Small to normally large mail sites cannot be reliable forwarding
>>> targets if they reject when an smtp.mailfrom results in a fail.
>>> So, I think it would be fair to require to also check smtp.helo in
>>> such cases, and accept the message if the it results in a pass. What
>>> do you think?
>>
>> most site owners on small sites have the ability to just whitelist
>> their webservers (our servers) sending ip, those that arnt able to
>> usually have to setup some sort of pop3 pickup if their mailsystem
>> dosnt allow reliable forwarding
>
>You mean FBL subscriptions? That's the last bullet point in John
>Levine's rough summary of forwarding:
>http://www.circleid.com/posts/how_spam_has_damaged_mail_forwarding_and_ways_to_get_around_it/

good article.
no im not on any FBL as were a tiny sender, but receive for many. (still tiny in global terms)
i just mean any user wishing to setup forwarding on an address here to external has to demonstrate the external can either

A whitelist mail from our IP to that RCPT (whitelist for content and mail-from checks) as the user scan set both filters on our receiving side and should do no further checking on subsequent hops.
B whitelist our ip system-wide (not our preference but often a limitation of many other MTA's/filters)
or if they cannot they have to go with pop3 pickup as we won't forward to places that might cause our systems to become back scatter sources




>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120409052211:7A590F74-8225-11E1-BC0C-E8C87D88F881
>Powered by Listbox: http://www.listbox.com
Michael Deutschmann
2012-04-21 01:27:55 UTC
Permalink
On Sun, 8 Apr 2012, Alessandro Vesely wrote:
> What about "generic" forwarders? I mean sites who provide a web-form
> to let users specify whatever address they like. They are obviously
> not going to hound ultimate servers' admins in order to have their
> site whitelisted.

Then they are doomed, and not just by SPF and the conspiracy against
bounces. IP-address karma systems (possibly involving a "This is Spam"
button) are an equally grave threat.

On this very list, people have complained about end-users who try to
manage their spam centrally, turning off spam filtering at the forwarder
and turning it up at the final MX. The result is a blackened IP
reputation of the forwarding handoff mailserver, which from the ultimate
recipient MX's perspective, looks like an open relay.

---- Michael Deutschmann <***@talamasca.ocis.net>
Scott Kitterman
2012-04-21 01:43:18 UTC
Permalink
Any chance we could consider this thread dead?

I think everything worth saying in it has been said at least once.

Scott K
alan
2012-04-21 02:22:52 UTC
Permalink
At 02:43 21/04/2012 Saturday, Scott Kitterman wrote:
>Any chance we could consider this thread dead?
>
>I think everything worth saying in it has been said at least once.

agreed


>Scott K
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120420214323:605BE88A-8B53-11E1-B369-A732D2193091
>Powered by Listbox: http://www.listbox.com
alan
2012-04-21 02:24:31 UTC
Permalink
At 02:27 21/04/2012 Saturday, Michael Deutschmann wrote:
>On Sun, 8 Apr 2012, Alessandro Vesely wrote:
>> What about "generic" forwarders? I mean sites who provide a web-form
>> to let users specify whatever address they like. They are obviously
>> not going to hound ultimate servers' admins in order to have their
>> site whitelisted.
>
>Then they are doomed, and not just by SPF and the conspiracy against
>bounces. IP-address karma systems (possibly involving a "This is Spam"
>button) are an equally grave threat.
>
>On this very list, people have complained about end-users who try to
>manage their spam centrally, turning off spam filtering at the forwarder
>and turning it up at the final MX. The result is a blackened IP
>reputation of the forwarding handoff mailserver, which from the ultimate
>recipient MX's perspective, looks like an open relay.

simple fix users who do this become ex-customers of the forwarder, its in our TOS it should be in theirs (and enforced)


>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120420212804:3B6F6FD0-8B51-11E1-B574-969066F90106
>Powered by Listbox: http://www.listbox.com
alan
2012-04-07 13:03:56 UTC
Permalink
may i suggest we take this offlist as I'm sure the debate about bouncing is really of no interest to
(and definitely not really relevant to SPF at all)

alan @ the domain in from:
rather than the tagged address here

At 05:21 07/04/2012 Saturday, Michael Deutschmann wrote:
>On Fri, 6 Apr 2012, G.W. Haywood wrote:
>> On Tue, 3 Apr 2012, Michael Deutschmann wrote:
>> > "Is it okay, on the modern internet, to send a bounce message outside
>> > of one's own bailiwick, when the original message had an SPF Pass
>> > result?"
>>
>> One simple answer. No.
>
>How about this variation:
>
>"Is it okay, on the modern internet, to assume that legitimate bounce
>messages between bailiwicks will not occur?"

yes they will, between sending machines and 3rd parties that are allowed to send via them
like anyone offering unauthenticated outbound relay from their IP's etc.

>That is, to declare that deadletters other people experience when they try
>to bounce something you *actually sent* are their own fault for not
>saluting the Conspiracy Against Bouncing.

If I actually sent it I accept the bounce (as its RCPT address exists so why in hell would I refuse a valid bounce??)
(I have never said in all of this that refusing mail due to <> in mailfrom is legitimate for anyone)
(in fact i welcome even likely backscatter so its possible to report the source and have them blacklisted for running the sloppy system that generates the abuse)
(obvious caveat if mail is from <> and to multiple recipients its not an NDR and is then treatable with suspicion)

>I'm suprised how vehement people are behind the No regarding the first
>question, but that may just be Postel's Law talking. ("Be conservative in
>what you send, liberal in what you accept.") Postel would also say No to
>the second one.

it is simply I do not run an abusive receiver, I know others do so do not refuse external bounces as my users being informed of delivery failures is paramount, i give users a simple 'report as backscatter' link in any <> they receive from external and preserve a copy for analasis so their hitting this for mail that is a legitimate bounce, results in them getting the larting not the sender.

>And on reflection, it's the second question that is most important. Some
>anti-spam strategies become far weaker if asked to treat a bounce message
>for failed delivery to <***@y> just as well as a normal message from <***@y>.

a delivery failure to ***@y is hard to deduce (due to NDR text not being in any standard format, possibly determinable by enumerating all the major formats, but not an exact science)

>Most dramatically, this applies to goldlisting, where any envelope sender
>not on the whitelist is rejected. If <> is not whitelisted, no bounce ever
>gets through. If <> is, anyone from any IP can circumvent the goldlist.

not really if you goldlist without using batv then yer kinda likely stuck,
we do not allow users to block for <> alone ever, but we do allow them to block all from known backscatter source-ips (ie using their deliverability/non-deliverability as leverage to cleanup)
or <> from known backscatter sources (ie just avoiding the likely backscatter but not rejecting all mail)
(batv users dont ever get allowed to block <> as long as the batv RCPT is correct)

>(One idea is to use SPF-checked HELO and/or rDNS to at least get a domain
>that can be coarsely checked against the whitelist. But that can easily
>fail, especially if the sending IP is a smarthost for many domains.)

90% of legitimate mail (here) is thusly sent from a smarthost
if you really wanted to try and guess if <> is possibly from a whitelisted/goldlisted address' system.

you would need to check the helo +/- rdns against the domains in the MXs of the domains you have whitelisted
(or better the IPs against the IPs you have already received whitelisted mail from)

Ie every legit mail from whitelisted address would cause the sending IP to be added to an allowed to send from <> in future list.
(again goldlisting/whitelisting by address i find never works as from address is trivially forged and few will have SPF/DKIM to aid forgery detection)
(blocking <> again I believe is both irresponsible and stupid and a disservice to your users)

users here that want to whitelist/goldlist or similar are advised to do so by more than one detail ie envelope-from:***@y AND SPF-pass or envelope-from:***@y AND helo *.domain.tld etc.
yes rules are usually 2 or 3 times longer but they are more likely to avoid the actual phishes and forgeries
(usually only addresses like mine above that are used legitimately only by one sender (this mailing-list-srv))

obviously they also need to look at their own server side rejection logs and ammend their rules when their contacts start reporting issues (moved their domain from smarthost at providerX to providerY for example)
as if the user wants Draconian filters they have to be willing to maintain them, we will educate and provide the tools but we don't have access to change their settings (as far as they are told) so the administration burden is entirely theirs)
Michael Deutschmann
2012-04-08 07:50:04 UTC
Permalink
On Sat, 7 Apr 2012, alan wrote:
> may i suggest we take this offlist as I'm sure the debate about
> bouncing is really of no interest to (and definitely not really relevant
> to SPF at all)
It is so germane to SPF, because we are discussing how SPF Pass changes
(or doesn't change) the situation.

As regards the no-SPF and SPF neutral-or-worse cases, I support the
Conspiracy unreservedly.

> we do not allow users to block for <> alone ever,

What if they blacklist an IP address range, and whitelist a specific
e-mail address that happens to come from a smarthost in that range?

Goldlisting is just the subset of that case where 0.0.0.0/0 is on the
private host blacklist.

> ok this is the one time bounces MAY legitimately occur (disk quotas)
Ooooooooooooh. So you're not a full conspiracy member after all.

Back in 2009, I was part of an argument on the now defunct
news.admin.net-abuse.blocklisting group with a guy named D.Stussy. He
was protesting that some of UCEProtect's backscatter list traps did not
have SPF records.

He considered it impossible to avoid bounces due to quota issues, and
thus held that only people with strict Pass-or-Fail SPF records,
allowing every last forgery to be detected and refused at the edge, were
entitled to freedom from backscatter.

I wonder which side you'd have been on, were you there. Remember, we were
explictly discussing *ALL* bounces, not just those arising from stubborn
end-users who want to contentfilter away from the edge.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-08 22:42:43 UTC
Permalink
At 08:50 08/04/2012 Sunday, Michael Deutschmann wrote:
>On Sat, 7 Apr 2012, alan wrote:
>> may i suggest we take this offlist as I'm sure the debate about
>> bouncing is really of no interest to (and definitely not really relevant
>> to SPF at all)
>It is so germane to SPF, because we are discussing how SPF Pass changes
>(or doesn't change) the situation.

you may be I'm saying It doesn't and shouldn't

>As regards the no-SPF and SPF neutral-or-worse cases, I support the
>Conspiracy unreservedly.
>
>> we do not allow users to block for <> alone ever,
>
>What if they blacklist an IP address range, and whitelist a specific
>e-mail address that happens to come from a smarthost in that range?

then the block is on ip and thus dosn't reference mailfrom as the issue obviously


>Goldlisting is just the subset of that case where 0.0.0.0/0 is on the
>private host blacklist.

gold listing actually involves blacklisting mail from <*@*> except the goldlist
ip is not a factor in goldlisting

why i said our users are advised to use more secure methods
(if you blacklist an ip then from is no longer even considered whitelisted or not)

>> ok this is the one time bounces MAY legitimately occur (disk quotas)
>Ooooooooooooh. So you're not a full conspiracy member after all.

there is no conspiracy, there is only constructing systems in a way that they are useable
(dont bounce or blackhole any mail)
and do not cause an abuse burden for others due to administrative lazyness or poorly engineered solutions

>Back in 2009, I was part of an argument on the now defunct
>news.admin.net-abuse.blocklisting group with a guy named D.Stussy. He
>was protesting that some of UCEProtect's backscatter list traps did not
>have SPF records.

why would they need spf records if not sending mail
(but equally yes every a or mx in a non-abusing domain should have an spf of "v=spf -all" if not doing mail or used in helo, and v=spf ~all if just a disbeliever in spf and doing mail)

>He considered it impossible to avoid bounces due to quota issues, and
>thus held that only people with strict Pass-or-Fail SPF records,
>allowing every last forgery to be detected and refused at the edge, were
>entitled to freedom from backscatter.

no one is entitled to freedom from backscatter/spam/abuse/annoying people/etc/etc??
we ARE entitled to complain/report/refuse all of the above ONLY

we equally have a duty to our users to not disrupt their mail and to others to not pollute the ecosystem.
so refusing bounces that may be legitimate to our users (which they want and need) would be stupid
(knowing many systems out there DO generate them)

equally we have a duty to not allow our systems to generate bounces to others (except when entirely unavoidable) and even then to ensure we minimize them (by in say overquota situations causing our user (the cause of the issue) to have extended problems receiving due to mx caching of the overquota status rather than generating 1 bounce per mail to innocent 3rd parties if we didn't)

also in the above case (say my domain with -all) how does this free me from backscatter from sender-smarthosts that allow their users to send mail forged from me, refused and then sending me the bounce??
(why i would then report them and add them to our own backscatter source list) so my users can choose to drop <> mail from them if they want to avoid backscatter or block all mail from them (if they want to avoid the spam that would be sent from such an abusable smarthost also)

>I wonder which side you'd have been on, were you there. Remember, we were
>explictly discussing *ALL* bounces, not just those arising from stubborn
>end-users who want to contentfilter away from the edge.

subbourn end-users don't and cant generate bounces, dumb/lazy/badly engineered receiving systems can and do, not their users.
(why shunning such systems causes the to get fixed or have their users leave)

you simply cant deal with all <> mail equally its idiotic to do so
as these can be
NDRs (bounces)
DSNs (mail not delivered yet)
autoreplys several ticketing systems and transactional mails where the sender is uninterested in knowing if the target received the message or not.

we on the other hand only generate <> (as far as were aware) for user overquota (DSN and NDR) or system down for over 8 hours (DSN)
we currently havn't had a customer system down for long enough to switch to 5xx to avoid excessive DSNing senders
(but we would rather cause them the pain than cause the net a DSN flood)
and ensure overquota causes 1 NDR per 15 mins max

I know some idiots do drop all incoming <>
(their systems their problem)
but i equally know of many companies that due to this had to change mail provider to someone who didn't
Michael Deutschmann
2012-04-10 21:42:53 UTC
Permalink
On Sun, 8 Apr 2012, alan wrote:
> then the block is on ip and thus dosn't reference mailfrom as the issue
> obviously

So you mean per-IP blacklisting trumps per-sender-address whitelisting?

Does that apply if the per-IP blacklisting is from a DNSBL and not a
manual entry?

Sender whitelisting is most commonly used to patch over the occasional
DNSBL false positive/collateral damage, without standing down the
defenses entirely. A sender whitelist that did not trump the IP-based
reputation would be useless for that purpose.


Coming back to SPF, regardless of what SPFv1 Pass means, it would be good
to have a differentition in SPFv3 between a "unbounceable pass" and a
"bounceable pass".

The distinction would not be used for spam filtering. Setting up a
conspiracy-compliant spam filter that doesn't blackhole is costly, but it
is a flat cost. Exempting "bounceable pass" messages doesn't save you
anything.

Also, even if the spammer has no right to complain of you bouncing back at
him, he can still be a jerk when you try to deliver that bounce.... Some
spammers might find it hiliarous to teergrube you, or endlessly 4xx.

Where it would help with is quota issues. The more bytes of unbounceable
mail a backup MX is allowed to queue, the bigger the worst-case quota
overrun on the primary. So a conspiracy-compliant MX will start 4xxing
incoming mail long before it comes near to running out of disk.

The MX could add a separate, larger reserve of queue space just for
bounceable mail -- knowing that if the primary stays down for a month, it
*can* try to shed the load. In the usual case where the primary does
come back eventually, then it can ETRN and the waiting mail can be on it's
way immediately. That's the sender's incentive to publish bounceable
pass.

But a goldlisting sender can't accept bounces without weakening its
defense considerably, so it would *prefer* to get 4xxed than to face
blackholing on the slim chance the message is flushed off the bounceable
queue and cannot be returned due to the goldlisting.

It would be even better to add a third SPF declaration: bouncing is ok if
and only if bounces can be reliably identified. An obvious way to do this
is to require both that the bounce be close enough to RFC 3464 & 6522 so
as to reliably extract the "Original-Recipient" field, that the bounce
actually contain one (it's optional by RFC 3464) and that SPF would have
Passed the message had that address been the MAIL FROM.

It requires content filtering for airtightness, but is practical since <>
is rare (and will stay that way if the filter is used), and it is
reasonable to demand only one RCPT per transaction. A message can have
many recipients but only one sender -- hence a bounce can only have one
recipient.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-11 01:44:25 UTC
Permalink
At 22:42 10/04/2012 Tuesday, Michael Deutschmann wrote:
>On Sun, 8 Apr 2012, alan wrote:
>> then the block is on ip and thus dosn't reference mailfrom as the issue
>> obviously
>
>So you mean per-IP blacklisting trumps per-sender-address whitelisting?
>
>Does that apply if the per-IP blacklisting is from a DNSBL and not a
>manual entry?

depends on the users preference (some use some dnsbls as just extra points to add to spamscore of content checks)
some dnsbl are a do-not pass (as any whitelisted sender from say pbl is obviously a bot forged spam/virus)
why we advise users if they want to 'whitelist' a sender to do it on more than 1 datapoint (so they whitelist only the sender not the forgeries claiming to be the sender)
so if (here its common for eircomnet to get blacklisted on say spamcop, or was a few years ago before they cleaned up)
so most users whitelisted that ip(s) from spamcop listings
(as they know the ip is legit and want mail from not just x)

whitelisting an address is only logical if whitelisting it from all further content checks
if the address was not previously bogus its unlikely to change, so whitelisting is unneccissary
(ie my virus and spam discussion mailinglist subscriptions are whitelisted from all content checks)

>Sender whitelisting is most commonly used to patch over the occasional
>DNSBL false positive/collateral damage, without standing down the
>defenses entirely. A sender whitelist that did not trump the IP-based
>reputation would be useless for that purpose.

if its to trump a dnsbl entry an ip whitelisting by that user is how its done
(either they believe the ip is clean or not, if they want to refuse mails from other users on that ip they would want to do it regardless of dnsbl reputation, and thus whitelist ***@y and blacklist *@y and whitelist the ip from all dnsbl, to have consistent results)

>Coming back to SPF, regardless of what SPFv1 Pass means, it would be good
>to have a differentition in SPFv3 between a "unbounceable pass" and a
>"bounceable pass".

it would not, if i sent you a mail from totally-***@alandoherty.net with a bounceable pass, it would still clog your dead letter queue as the recipient still dosnt exist for you to return a bounce too.
(in my case as i have per-user spf1 records it would in fact get a record of -all after expansion, but most spf implementers dont save others from their users typo's like we do)

all reasonable senders accept bounces, any that don't should not expect receivers to suppress them artificially
(as blackholed mail is more counterproductive than backscatter)

all reasonable receivers don't (normally) bounce

all unreasonable senders (those that allow their users to forge envelope-sender) will be souces of backscatter when talking to reasonable receivers, and will get dnsbled till they clean up if/when they become sources of backscatter to innocent/forged 3rd parties.

all unreasonable receivers (those that accept then bounce) will generate backscatter themselves (masking the unreasonable sender) and thus equally get dnsbled till they clean up if/when they become sources of backscatter to innocent/forged 3rd parties.

like open relays firstly the unreasonable receivers will have to clean up, in time all senders wanting to be accepted anywhere will also have to cleanup.
(we still have open relays but vanishing few and all on every dnsbl)
eventually abusive recievers will be a thing of the past, a long time later abusive senders will not last long before they get listed due to the recievers that currently mask them being removed

we should not advocate blackholeing or any system that cripples the legitimate flow of the (few but necessary)legitimate external bounces (such as mailbox full, message delayed but still in transit etc[host down/disk full/etc])
just to fix the symptom(backscatter) rather than fixing the problem(otherwise legitimate sender systems that allow their users to and the bots on their pc's to willfully forge)

if ultimately senders cannot forge then like me the only mail a bot(on my pc) could send via my smarthost would result in me getting a flood of NDRs alerting me to the bot using my account)
if the same bot tried direct MX sends no bounces (as all refused due to my pcs IP being in pbl, as its not ip space allowed to direct to MX)

>The distinction would not be used for spam filtering. Setting up a
>conspiracy-compliant spam filter that doesn't blackhole is costly,

blackholing is in no way compliant its just broken
its not costly to engineer systems well/propery (ie if you didn't reject it at the border when you checked it for deliver ability/spammyness/source reputation/etc/etc, then deliver it, if later checks make it look less desirable put it in a spamfolder if you wish but deliver it to the user

> but it is a flat cost. Exempting "bounceable pass" messages doesn't save you
>anything.
>
>Also, even if the spammer has no right to complain of you bouncing back at
>him,

if you reject there is no bounce

>he can still be a jerk when you try to deliver that bounce....

if its sent as a bounce your sending to the forged from 99% not the spammer, why bouncing is abusive

> Some spammers might find it hiliarous to teergrube you, or endlessly 4xx.

no spammers need to the forge the from

>Where it would help with is quota issues.

no it wouldn't

> The more bytes of unbounceable

there is no such thing as (unbounceable mail) if the bounce is legitimately generated

>mail a backup MX is allowed to queue,

if the mailbox is full the backup MX should be 5xx or 4xx ing the mail to sender saying so
not queing mail and lying to the sender claiming its been accepted/delivered
(legit senders want to know asap if they should be phoning the recipient as the mail will likely not get through)

> the bigger the worst-case quota overrun on the primary.

why it shouldn't queue, as 90% of quota overuns are dead/absent/gone/retired/quit/negligent users who lacked the decency to close the account queing in most cases is counterproductive for them and the legitimate senders attempting to mail them
(and the forged-from victims now subject to daily 'your message to x has yet to be delivered' DSNs) why we 5xx and cache.

> So a conspiracy-compliant MX will start 4xxing
>incoming mail long before it comes near to running out of disk.

it should 4xx or 5xx when 4xx'd or 5xx'd from the downstream.

>The MX could add a separate, larger reserve of queue space just for
>bounceable mail -- knowing that if the primary stays down for a month, it
>*can* try to shed the load.

why should it? the sender (if legit) will cache the mail, if non-legit it won't which is a side-benefit

>In the usual case where the primary does come back eventually,
>then it can ETRN

(does any mailserver trust/implement ETRN? i know we do if the domain and connecting ip match (through custom written code), no customer system has ever been found that can avail of it, most customers manually dequeue by issuing 'finger ***@our.mx' from their mailserver (as it is available on widows and unixes and hits our custom listener which only accepts the connect from their ip's and does the same domain/ip matching before dequeue)

>and the waiting mail can be on it's way immediately.

just as easily achieved

>That's the sender's incentive to publish bounceable pass.

so the senders only incentive is that the receiver should silent queue delayed mail, rather than let them queue and let their own policy decide when and how often their own users should be sent 'mail still waiting' DSNs

hardly an incentive?

>But a goldlisting sender can't accept bounces without weakening its
>defense considerably,

err how? a goldlister may have sloppy recievers(bouncers) they need to communicate with, thus they still need to know when their legitimate mail was not delivered due to a misfire of internal content scanner or other)

> so it would *prefer* to get 4xxed

or 5xxd

>than to face blackholing on the slim chance the message is flushed off the bounceable
>queue and cannot be returned due to the goldlisting.

if a goldlister that you describe exists
A their sending system would have to insist the also cannot mail addresses other than those in their 'gold-list'
(obviously as allowing out to addresses not allowed to reply is pointless)
B thus their sending system can easily enumerate that <> from the ip's that are MXs for such goldlist address' and ips that have previously sent from a goldlist address, or are in a goldlist addess's SPF are obviously unlikely to be anything but legitimate bounces (this allowed to <> list could be automatically enumerated and added to every time a new goldlist address is added and refreshed every time one is emailed (as mxs and spfs change)
C bounces can all be allowed to goto data phase (as no legit <> can be to multiple recipients) and thus searched for lines like ***@y mailbox full etc (where address in message body is a goldlist address, or ip in returned headers is a goldlist MX, to catch the occasional edge case multi-stage inbound relays sending from alien IP

but our users thus far that blacklist *@* and whitelist a few have never complained that the whitelist always includes <>
those that do worry about fake bounces opt to turn on batv

>It would be even better to add a third SPF declaration: bouncing is ok if
>and only if bounces can be reliably identified. An obvious way to do this
>is to require both that the bounce be close enough to RFC 3464 & 6522 so
>as to reliably extract the "Original-Recipient" field, that the bounce
>actually contain one (it's optional by RFC 3464) and that SPF would have
>Passed the message had that address been the MAIL FROM.

again spf (sender policy about what ip's my mail originates from)
should not I strongly believe, be subverted to make any declaration about my entirely unrelated receiver policy.
(whether its my policy about receiving spam or bounces)

>It requires content filtering for airtightness, but is practical since <>
>is rare (and will stay that way if the filter is used), and it is
>reasonable to demand only one RCPT per transaction. A message can have
>many recipients but only one sender -- hence a bounce can only have one
>recipient.

we have enough unclean systems and systems incapable of even using spf v1 and dkim etc etc
backscatter and associated issues ONLY originate on these

subverting spf to say anything about reception/reply/bounce policy will not clean any of these or lessen the damage they do
(bandwith connections per minute etc. etc.)

but it will make all legitimate receivers, currently ONLY generating DSNs and NDRs to legitimate edge case senders (when mailbox full, and only to the first sender(as all later get the cached 5xx/4xx, first sender got the cached 2xx)

suddenly both non-compliant and require re-engineering working systems to become worse/broken to suppress NDRs and DSNs to the few senders(of the even fewer using any spf) that choose to publish such a policy

which helps none of the current victim receivers of backscatter, as 99% of backscatter is from broken systems (who dont/cant check spfv1) and to mainly domains not publishing any spf (as no intelligent spammer forges a from that can be detected via spf easilly)

spf is to cut down forgery by bad senders, to enable receivers to detect such forgery and reject

let the victims of backscatter report and deal with the bad senders, and sloppy receivers
(for most it is their only incentive to add SPF to stop their domains being easily forged)
if you wish to help fix the issue shun such bad receivers and senders by using backscatter dnsbls with appropriate responses (with exceptions when/if your users need them) and ensuring your systems arn't causing unnecessary NDRs and DSNs

but a new protocol that breaks good systems is not going to help anyone

broken systems cant be fixed by anyone but their owners, we can only give them incentive to fix their systems by refusing their users mail till their users force them to change.

this is how we fixed all the open relays,
this is how we'll fix senders that allow forged mail out
this is how we'll fix receivers that accept mail our SPF fail told them not to, then bounce the forged spam back to us.

if they didn't follow your spf policy to reject the mail, then why would they now stop sending the bounces.

if your spf ends ?all then you claim that your user might be sending from outside your ip's why should that user then not receive any legitimate bounces?

if your spf ends ~all then (well ive never claimed to understand what a receiver should do, for me its mark it for spamfolder even if it passes content filters.) still no reason to complain about later bounces as you didn't tell them to reject

but equally no excuse for not accepting the bounces
Michael Deutschmann
2012-04-12 03:55:40 UTC
Permalink
On Wed, 11 Apr 2012, alan wrote:
> no spammers need to the forge the from

Most do so, preying upon senders who do not use SPF -all and recipients
who don't act on SPF Fail. But others use their own domains, preying on
recipients who foolishly upscore on SPF Pass alone. (They also use DKIM
the same way.)

SPF Pass *and* a known sender is a quite strong indicator of non-spam.
But the known sender is essential. {SPF Neutral or None, known alleged
sender} is a much more trustworthy mail stream than {SPF Pass, unknown
sender}.

> if the mailbox is full the backup MX should be 5xx or 4xx ing the mail

For there to be any point in a backup MX, the backup has to be able to
accept mail while it has no connectivity to the primary. It thus cannot
rely on knowing precisely how full the mailbox is.

A system can be engineered that is safe from out-of-disk problems. While
in contact, the primary and backup agree on a space reservation the backup
can use when out of contact. If the reservation runs out, then the backup
starts 4xxing outside senders. When contact is reestablished, the backup
will unload the queue (always suceeding because the space was
pre-reserved), and attempt to refill its reservation (usually suceeding
but not if the mailbox is now over the quota promised to the end user.)

> >In the usual case where the primary does come back eventually,
> >then it can ETRN

The ETRN is purely in-bailiwick, between the primary MX and the backup MX
who are configured to use it. It's never visible on the outside internet.
ETRN is a standard protocol to do this, but if it didn't exist I'd have
said "primary MX admin does something like `ssh backup-mx exim -qqf' "

> >and the waiting mail can be on it's way immediately.
>
> just as easily achieved

The point is that the recipient's backup MX is likely to know immediately
when the primary comes up, by explicit administrator action. The sender's
smarthost does not. Eventual delivery depends on the whims of the
sender retry schedule.

(I'll get to the rest of your original message later...)

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-12 10:14:17 UTC
Permalink
At 04:55 12/04/2012 Thursday, Michael Deutschmann wrote:
>On Wed, 11 Apr 2012, alan wrote:
>> no spammers need to the forge the from
>
>Most do so, preying upon senders who do not use SPF -all and recipients
>who don't act on SPF Fail. But others use their own domains, preying on
>recipients who foolishly upscore on SPF Pass alone. (They also use DKIM
>the same way.)
>
>SPF Pass *and* a known sender is a quite strong indicator of non-spam.
>But the known sender is essential. {SPF Neutral or None, known alleged
>sender} is a much more trustworthy mail stream than {SPF Pass, unknown
>sender}.

first OUT OF CONTEXT

(you claimed of bounces to spammers (assuming a non forged from))
> Some spammers might find it hiliarous to teergrube you, or endlessly 4xx.

no spammers need to the forge the from
(actually my punctuating and missing y mistake)
no spammers need to, they forge the from

(some spammers don't but thats what ip and domain based RBLs/ are for )

as for receivers that upscore content based on forgery/non-forgery status
A not our problem (were trying to cleanup senders, receivers who want to get more spam we can't force to fix)
B they will learn or drown eventually
C refusing for spf fail is not spam related its forgery related, content isn't the issue sender policy is, the fact it kills a lot of spam is an accidental bonus.
(side policys like giving extra 'spammyness/lack of clue of sender' score for +all, i think is fine still, but ?all is just indicative of a users provider not providing a submission server to the user (like old isps who just allow user outgoing service on port 25 from their ip range only, so their users are forced to use other relays when traveling/abroad, yes it makes them vulnerable to abuse, but no more so than an spf pass for same address (ie a bot on correct ip range sending via same smarthost with ***@isp.domain)

as i said before such senders are refusable based on their allowance of forgeries, both the local (spf pass) and remote (spf neutral) as both allowed the sender to stick anything in their envelope-from based on ip (both provide bots service), refusing them (based on ip) will encourage them to cleanup their setup and eventually provide submission servers/authentication/and forgery controll, then once they are clean senders -all/~all spf records.

in cases like above spf pass and known sender is no indication of non-spam, (only indicator that the address [if forged] was forged by a bot on the same badly run isp, why content checks are still needed.

senders should be/are only whitelisted from content checks IF they regularly send content that triggers them that is still wanted. others needn't be

(in fact most freemail accounts tend to be stolen/used by spammers entirely because they know this gets to users who don't content check their 'friends' so this policy only incentivises this theft)

>> if the mailbox is full the backup MX should be 5xx or 4xx ing the mail
>
>For there to be any point in a backup MX, the backup has to be able to
>accept mail while it has no connectivity to the primary. It thus cannot
>rely on knowing precisely how full the mailbox is.

why i said it should cache the result of previous attempt
(ie first attempt that gets a 5xx or 4xx (when issue occours) gets cached for period of time, this and callforwards ensures that a quota issue causes only 1 bounce)
and in real terms today no backup mx is cut off from primary for long or often enough in real terms
nowdays multi mx setups are more to spread the load of edge servers (and all the filtering they must perform at smtp time) so the post filtering load/bandwith on the mailbox server is negligible
for our customers the driving force is so their tiny dsl line dosnt have to take the 99% of connections that end in 5xx, for most others its unlikely to be much different, dialup/isdn and intermittently connected mailbox servers are vanishingly small today, and most do not use smtp as the transport if they exist (domain pop3 in is common and much easier, with a http gui to add/remove stale addresses on the provider/MX side, also works with exchange and fetchmail)

>A system can be engineered that is safe from out-of-disk problems. While
>in contact, the primary and backup agree on a space reservation the backup
>can use when out of contact.

and this redesign of smtp is achieved how?

>If the reservation runs out, then the backup
>starts 4xxing outside senders. When contact is reestablished, the backup
>will unload the queue (always suceeding because the space was
>pre-reserved), and attempt to refill its reservation (usually suceeding
>but not if the mailbox is now over the quota promised to the end user.)

or easier, as no redesign of smtp is needed, if i see a customers host being often intermittently unavailable, i phone and suggest they should move to a non smtp delivery method, such as domain-pop3, where they admin the valid recipients list on our side because their system cannot be relied on to be available for callforwards
(btw a callforward fail just causes a 4xx to sender, as our edge servers do not ever accept a mail that may bounce, were their to filter their mail and increase the attack-surface not to reduce sender queues)

>> >In the usual case where the primary does come back eventually,
>> >then it can ETRN
>
>The ETRN is purely in-bailiwick, between the primary MX and the backup MX
>who are configured to use it. It's never visible on the outside internet.
>ETRN is a standard protocol to do this, but if it didn't exist I'd have
>said "primary MX admin does something like `ssh backup-mx exim -qqf' "
>
>> >and the waiting mail can be on it's way immediately.
>>
>> just as easily achieved
>
>The point is that the recipient's backup MX is likely to know immediately
>when the primary comes up, by explicit administrator action. The sender's
>smarthost does not. Eventual delivery depends on the whims of the
>sender retry schedule.

mail delays are less of an issue (if receiver system stability is the cause) than abusing senders and potentially forged 3rd parties by accepting mail that may never get to its destination, then later blackholing or returning bounces (which in turn may never get to the recipient due to their admins dumb filtering), if the messages do ultimately fail.

sorry but the majority of users would gladly put up with occasional delays (and more reliable delivery status information)
over never reliably knowing if/when a message got through, due to 'fake 2xx' and no further information.
Michael Deutschmann
2012-04-21 00:26:25 UTC
Permalink
On Wed, 11 Apr 2012, alan wrote:
> if a goldlister that you describe exists
> A their sending system would have to insist the also cannot mail
> addresses other than those in their 'gold-list'

Of course. Or it can do the converse, automatically adding outgoing
recipient addresses to a dynamic whitelist. Which is, in turn, the line
of thinking that led me to this issue.

If the end-user is offered a flexible spam control panel and such a
dynamic whitelist, he will be tempted to set his spam defenses extremely
high, as the whitelist will save him from the false positives that would
otherwise make him back off. The result is a gradual slide towards an
effective goldlisting policy.

> B thus their sending system can easily enumerate that <> from the ip's
> that are MXs for such goldlist address' and ips that have previously sent
> from a goldlist address, or are in a goldlist addess's SPF are obviously
> unlikely to be anything but legitimate bounces (this allowed to <> list
> could be automatically enumerated and added to every time a new goldlist
> address is added and refreshed every time one is emailed (as mxs and spfs
> change)
Yuck. Among other problems this can't work with the exists mechanism.

> C bounces can all be allowed to goto data phase (as no legit <> can be
> to multiple recipients) and thus searched for lines like ***@y mailbox full
> etc (where address in message body is a goldlist address, or ip in
> returned headers is a goldlist MX, to catch the occasional edge case
> multi-stage inbound relays sending from alien IP
Something like this is the way to go, but as-is it doesn't scale. You
have to check every line of the putative bounce against every address in
the whitelist. (A dynamic whitelist could get rather big.)

What's needed is a way to analyze the message and derive the original
recipient. This would be trivial if everyone implemented RFC 3464, but
many do not. (Including Exim, the MTA I use. Its author was never a
fan of MIME.)

> subverting spf to say anything about reception/reply/bounce policy will
> not clean any of these or lessen the damage they do

SPFv3 should say something about bouncing because without SPF the
conspiracy implies a bounce policy that some senders find convenient --
that they should never ever happen. SPF pass removes the conspiracy's
rationale of protecting innocents, since any backscatter of SPF-pass mail
is (at least equally) the fault of the putative sender.

In an SPFv3, instead of just "+", I'd like the choice of saying:

* Pass, so you are free to act like it's 1990.
* Pass, but I explicitly do not release you from the demands of the
conspiracy. Mail acceptance is still absolutely binding. I'd rather be
4xxed than have to deal with a post-transactional rejection.
* Pass, but please note that only bounces following a minimum
specification (that any RFC 6522 compliant bounce with an RFC 3464
component would be guaranteed to pass) and arriving from a server which
would have had an SPF pass if the original recipient was used in place of
MAIL FROM, can be expected to be delivered.

After the publication of this hypothetical SPFv3, I could set my SPFv1
record to "?a -all". Then any disregard of my chosen bounce policy would
be willful -- if they don't grok SPFv3, then they see Neutral and are
risking the wrath of the conspiracy should they not assume the worst.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-04-21 02:37:27 UTC
Permalink
again simply
bounce or anti-bounce policy is an ecosystemwide choice to remove the avenue for abuse
(like removing open relays were)

spf is an anti-forgery policy for senders
(it has always been up to receivers to do as they please with the results)

to shoehorn other side issues into spf in any form (especially issues that are NOTHING to do with sender policy)
Is simply patently a dumb idea.

suppressing bounces to one sender opposed to another is DUMB
(spf is only supposed to suppress bounces by allowing you to reject immediately forged mail)

If you ignored the spf and accepted the mail, then later bounce it should not be used to suppress bounces to that domain when non-spf users do not get the same treatment,
you either obey the spf (and the domain dosn't receive bounces from you, just the forger), or IF you accept then deliver. if delivery generates a bounce(say mailbox full) then deliver it too.

tighten your acceptance policy ONLY as this is where the spammers get paid, anything else isnt fixing the problem or lessening the abuse its just masking it from your users (blackholing spam) or masking it from the legitimate senders and abused (blackholing bounces) both are part of the problem not an aid to the solution.

At 01:26 21/04/2012 Saturday, Michael Deutschmann wrote:
>On Wed, 11 Apr 2012, alan wrote:
>> if a goldlister that you describe exists
>> A their sending system would have to insist the also cannot mail
>> addresses other than those in their 'gold-list'
>
>Of course. Or it can do the converse, automatically adding outgoing
>recipient addresses to a dynamic whitelist. Which is, in turn, the line
>of thinking that led me to this issue.
>
>If the end-user is offered a flexible spam control panel and such a
>dynamic whitelist, he will be tempted to set his spam defenses extremely
>high, as the whitelist will save him from the false positives that would
>otherwise make him back off. The result is a gradual slide towards an
>effective goldlisting policy.
>
>> B thus their sending system can easily enumerate that <> from the ip's
>> that are MXs for such goldlist address' and ips that have previously sent
>> from a goldlist address, or are in a goldlist addess's SPF are obviously
>> unlikely to be anything but legitimate bounces (this allowed to <> list
>> could be automatically enumerated and added to every time a new goldlist
>> address is added and refreshed every time one is emailed (as mxs and spfs
>> change)
>Yuck. Among other problems this can't work with the exists mechanism.
>
>> C bounces can all be allowed to goto data phase (as no legit <> can be
>> to multiple recipients) and thus searched for lines like ***@y mailbox full
>> etc (where address in message body is a goldlist address, or ip in
>> returned headers is a goldlist MX, to catch the occasional edge case
>> multi-stage inbound relays sending from alien IP
>Something like this is the way to go, but as-is it doesn't scale. You
>have to check every line of the putative bounce against every address in
>the whitelist. (A dynamic whitelist could get rather big.)
>
>What's needed is a way to analyze the message and derive the original
>recipient. This would be trivial if everyone implemented RFC 3464, but
>many do not. (Including Exim, the MTA I use. Its author was never a
>fan of MIME.)
>
>> subverting spf to say anything about reception/reply/bounce policy will
>> not clean any of these or lessen the damage they do
>
>SPFv3 should say something about bouncing because without SPF the
>conspiracy implies a bounce policy that some senders find convenient --
>that they should never ever happen. SPF pass removes the conspiracy's
>rationale of protecting innocents, since any backscatter of SPF-pass mail
>is (at least equally) the fault of the putative sender.
>
>In an SPFv3, instead of just "+", I'd like the choice of saying:
>
> * Pass, so you are free to act like it's 1990.
> * Pass, but I explicitly do not release you from the demands of the
>conspiracy. Mail acceptance is still absolutely binding. I'd rather be
>4xxed than have to deal with a post-transactional rejection.
> * Pass, but please note that only bounces following a minimum
>specification (that any RFC 6522 compliant bounce with an RFC 3464
>component would be guaranteed to pass) and arriving from a server which
>would have had an SPF pass if the original recipient was used in place of
>MAIL FROM, can be expected to be delivered.
>
>After the publication of this hypothetical SPFv3, I could set my SPFv1
>record to "?a -all". Then any disregard of my chosen bounce policy would
>be willful -- if they don't grok SPFv3, then they see Neutral and are
>risking the wrath of the conspiracy should they not assume the worst.
>
>---- Michael Deutschmann <***@talamasca.ocis.net>
>
>
>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120420202632:A40159AE-8B48-11E1-8A80-A2406E639DDA
>Powered by Listbox: http://www.listbox.com
Scott Kitterman
2012-04-21 03:25:04 UTC
Permalink
On Saturday, April 21, 2012 03:37:27 AM alan wrote:
> again simply

... I think everything's been said and people are repeating themselves.
Please leave it.

Scott K
Michael Deutschmann
2012-05-04 12:12:14 UTC
Permalink
On Fri, 20 Apr 2012, Scott Kitterman wrote:
> ... I think everything's been said and people are repeating themselves.
> Please leave it.

Okay, I'll agree to disagree on the fine points of the Conspiracy
Against Bounces. But on further reflection, that doesn't let SPF off
the hook. Reform is needed no matter who was right, it's just different
reforms.


If I'm right, and the Conspiracy treats all bounces of
SPF-neutral-or-worse mail the same, then an alternative SPFv3 qualifier
that says "This is definitely not forged. However, notwithstanding the
implication that a bounce of this message would never be backscatter, you
must still treat delivery as absolutely final, 'cause I'm doing leet hax
that count on the absence of bounces." would be useful.

If Alan is right, and the Conspiracy only applies to a subset of bounces
that are relatively easy to prevent and would be extremely common if not
so prevented (that is, spam filters and nonexistent addresses), then we
have a different problem, actually even more serious.

To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
all the mailboxes, a whitelisting site would have to use VERP such as
BATV. But automatic whitelisting fails when other people VERP in the
same way. We have a sustainability problem.

I'd fix that by coming up with a "standard SPF VERP", and then adding a
modifier to SPFv1 to indicate that it is in use. Then without the
modifier, the existing precedent that SMTP local parts are opaque would
apply. With the option, the recieving MTA would be encouraged to apply
a published algorithm to derive a whitelist key from the MAIL FROM it
sees.

(If BATV was adopted as the standard VERP, then the algorithm would be
"discard text from the left of the localpart up to and including the
second '=' character, keep the rest.".)

---- Michael Deutschmann <***@talamasca.ocis.net>
Scott Kitterman
2012-05-04 13:50:42 UTC
Permalink
On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
> all the mailboxes, a whitelisting site would have to use VERP such as
> BATV. But automatic whitelisting fails when other people VERP in the
> same way. We have a sustainability problem.

The way that SPF attempts to deal with null mail from now is with HELO based
checks. These are arguably far less useful.

Many people have reported a sharp decline in spam related backscatter after
they publish an SPF record (I actually got one of these last week and it
really confused me because it'd been years since I got one). There is lots of
empirical evidence that SPF can act as a deterrent to having your domain being
picked at random to be forged by spammers (not 100% deterrent, but a
deterrent).

Spammers to have not adapted to SPF by moving to null mail from's. They've
adapted by picking other domains to forge or setting up their own domains with
spam friendly registrars and/or often using stolen/forged credentials and
payment methods.

I agree that SPF does not (and cannot) deal with the null mail from very well,
but it's not clear to me it's a pressing issue.

> I'd fix that by coming up with a "standard SPF VERP", and then adding a
> modifier to SPFv1 to indicate that it is in use. Then without the
> modifier, the existing precedent that SMTP local parts are opaque would
> apply. With the option, the recieving MTA would be encouraged to apply
> a published algorithm to derive a whitelist key from the MAIL FROM it
> sees.

Google SPF SES sender -aws -amazon this isn't a new idea.

Scott K
Alessandro Vesely
2012-05-04 18:45:33 UTC
Permalink
On Fri 04/May/2012 20:20:10 +0200 Scott Kitterman wrote:
> On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
>> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
>> all the mailboxes, a whitelisting site would have to use VERP such as
>> BATV. But automatic whitelisting fails when other people VERP in the
>> same way. We have a sustainability problem.
>
> The way that SPF attempts to deal with null mail from now is with HELO based
> checks. These are arguably far less useful.

Why?

> Spammers have not adapted to SPF by moving to null mail from's.

That's a well known recipe to get your message rejected, see
http://www.rfc-ignorant.org/policy-dsn.php

I wonder whether reject-on-fail is statistically more relevant than
reject-null-mailfrom. In any case, from a spammer's POV, it makes
sense to try and avoid both of those pitfalls at the same time.
Scott Kitterman
2012-05-04 18:54:30 UTC
Permalink
On Friday, May 04, 2012 08:45:33 PM Alessandro Vesely wrote:
> On Fri 04/May/2012 20:20:10 +0200 Scott Kitterman wrote:
> > On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
> >> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
> >> all the mailboxes, a whitelisting site would have to use VERP such as
> >> BATV. But automatic whitelisting fails when other people VERP in the
> >> same way. We have a sustainability problem.
> >
> > The way that SPF attempts to deal with null mail from now is with HELO
> > based checks. These are arguably far less useful.
>
> Why?

Because the HELO name can be anything, so arranging for an SPF HELO pass is
trivial.

> > Spammers have not adapted to SPF by moving to null mail from's.
>
> That's a well known recipe to get your message rejected, see
> http://www.rfc-ignorant.org/policy-dsn.php
>
> I wonder whether reject-on-fail is statistically more relevant than
> reject-null-mailfrom. In any case, from a spammer's POV, it makes
> sense to try and avoid both of those pitfalls at the same time.

True. So maybe SPF just shouldn't care about that case. No Mail From, not
our problem.

Scott K
Alessandro Vesely
2012-05-05 11:08:00 UTC
Permalink
On Sat 05/May/2012 11:42:27 +0200 Scott Kitterman wrote:
> On Friday, May 04, 2012 08:45:33 PM Alessandro Vesely wrote:
>> On Fri 04/May/2012 20:20:10 +0200 Scott Kitterman wrote:
>>> On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
>>>> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
>>>> all the mailboxes, a whitelisting site would have to use VERP such as
>>>> BATV. But automatic whitelisting fails when other people VERP in the
>>>> same way. We have a sustainability problem.
>>>
>>> The way that SPF attempts to deal with null mail from now is with HELO
>>> based checks. These are arguably far less useful.
>>
>> Why?
>
> Because the HELO name can be anything, so arranging for an SPF HELO pass is
> trivial.

You must mean address literals, which are mostly used by MUAs AFAIK.
Addresses like <postmaster@[66.39.2.7]> most likely don't work.
With that exception, the domain of an MFROM can be anything that a
HELO name can be.

At any rate, arranging for an SPF HELO /neutral/ is trivial. A HELO
/pass/ is as reliable as a DKIM pass: both of them authenticate a
relay by referring to the corresponding DNS zone.

>>> Spammers have not adapted to SPF by moving to null mail from's.
>>
>> That's a well known recipe to get your message rejected, see
>> http://www.rfc-ignorant.org/policy-dsn.php
>>
>> I wonder whether reject-on-fail is statistically more relevant than
>> reject-null-mailfrom. In any case, from a spammer's POV, it makes
>> sense to try and avoid both of those pitfalls at the same time.
>
> True. So maybe SPF just shouldn't care about that case. No Mail From, not
> our problem.

I agree that HELO checking is somewhat ambiguous by design, since it
is optional, but its result can neither cause rejection[*] nor be
merged with the result of the mandatory check. However, pruning it
doesn't seem to yield grand simplifications either.

[*] HELO checking won't deliver a fail, unless misconfigured. That
is, anyone can say "HELO hostnotfound.google.com" and get away with it.
alan
2012-05-05 13:20:37 UTC
Permalink
At 12:08 05/05/2012 Saturday, Alessandro Vesely wrote:
>On Sat 05/May/2012 11:42:27 +0200 Scott Kitterman wrote:
>> On Friday, May 04, 2012 08:45:33 PM Alessandro Vesely wrote:
>>> On Fri 04/May/2012 20:20:10 +0200 Scott Kitterman wrote:
>>>> On Friday, May 04, 2012 05:12:14 AM Michael Deutschmann wrote:
>>>>> To avoid spammers using "MAIL FROM: <>" as a "skeleton key" that opens
>>>>> all the mailboxes, a whitelisting site would have to use VERP such as
>>>>> BATV. But automatic whitelisting fails when other people VERP in the
>>>>> same way. We have a sustainability problem.
>>>>
>>>> The way that SPF attempts to deal with null mail from now is with HELO
>>>> based checks. These are arguably far less useful.
>>>
>>> Why?
>>
>> Because the HELO name can be anything, so arranging for an SPF HELO pass is
>> trivial.
>
>You must mean address literals, which are mostly used by MUAs AFAIK.
>Addresses like <postmaster@[66.39.2.7]> most likely don't work.
>With that exception, the domain of an MFROM can be anything that a
>HELO name can be.
>
>At any rate, arranging for an SPF HELO /neutral/ is trivial. A HELO
>/pass/ is as reliable as a DKIM pass: both of them authenticate a
>relay by referring to the corresponding DNS zone.

helo authentication can be a great idiot filter (not spamsign but like ptr>A>ip FQRDNS check can be great reason to reject)
as long as whitelisting is possible for some idiots

non-pass if spf exists is pretty much a guarenteed reject for most of my users (except for facebook, as most of their servers have broken helo spf or broken helo A records)

>>>> Spammers have not adapted to SPF by moving to null mail from's.
>>>
>>> That's a well known recipe to get your message rejected, see
>>> http://www.rfc-ignorant.org/policy-dsn.php
>>>
>>> I wonder whether reject-on-fail is statistically more relevant than
>>> reject-null-mailfrom. In any case, from a spammer's POV, it makes
>>> sense to try and avoid both of those pitfalls at the same time.
>>
>> True. So maybe SPF just shouldn't care about that case. No Mail From, not
>> our problem.
>
>I agree that HELO checking is somewhat ambiguous by design, since it
>is optional, but its result can neither cause rejection[*] nor be
>merged with the result of the mandatory check. However, pruning it
>doesn't seem to yield grand simplifications either.
>
>[*] HELO checking won't deliver a fail, unless misconfigured. That
>is, anyone can say "HELO hostnotfound.google.com" and get away with it.

not immediate reject (just like connecting from blacklisted IP, the reject happens at RCPT time the reject message says why)
its not mis-configuration its sanity checking, and a good way to filter both bots and mailservers that a setup badly (thus unlikely to be sending anything usefull/wanted)
as mail has gotten to the rcpt stage the user can see the mail-from helo-id ip and fqrdns in their reject log and whitelist if neccissary, more-often they will just point the far side at our 'how you should setup your mta' guide and let them fix the issue that caused the reject, rather than turning off the checks and maintaining their own whitelist.

when you give users the option and they see the amount of spam it cuts from their spambox they usually exercise it, and thus senders are forced to distinguish themselves better from spammers/spambots.

helo pass is trivial for a legit mta, any hardfail softfail or neutral is pretty inexcusable



>-------------------------------------------
>Sender Policy Framework: http://www.openspf.net [http://www.openspf.net]
>Modify Your Subscription: http://www.listbox.com/member/ [http://www.listbox.com/member/]
>
>Archives: https://www.listbox.com/member/archive/735/=now
>RSS Feed: https://www.listbox.com/member/archive/rss/735/13124949-0b42f103
>Modify Your Subscription: https://www.listbox.com/member/?&
>Unsubscribe Now: https://www.listbox.com/unsubscribe/?&&post_id=20120505070834:A702220E-96A2-11E1-BAEA-F4BFA65CF08C
>Powered by Listbox: http://www.listbox.com
Michael Deutschmann
2012-05-06 01:17:19 UTC
Permalink
On Sat, 5 May 2012, Alessandro Veseley wrote:
> > Because the HELO name can be anything, so arranging for an SPF HELO
> > pass is trivial.
>
> You must mean address literals, which are mostly used by MUAs AFAIK.

No, it has nothing to do with [] in addresses.

The problem is that the HELO domain is of no use in determining if an
incoming MAIL FROM: <> has anything to do with a message you actually
sent in the past month.

gmail.com's MXes and smarthosts are kept within the domain of their
corporate sponsor, google.com. If gmail.com were ever to issue a bounce,
it would likely bear a HELO ending in .google.com. So a naive algorithm
that said "let a purported bounce through if the HELO is SPF-approved and
is equal to or a subdomain of any domain we have mailed to in the past
month" would fail badly for at least one major site.

Drop the "is equal to or a subdomain" requirement, and any spammer who
wants to exploit the <> loophole will do so using a HELO domain that he
fully owns. Then it's trivial for him to engineer a genuine SPF Pass.

Thus, for spam control purposes it is best to ignore the HELO (aside from
certain idiot filters), and treat all <> mail as effectively SPF-neutral.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-05-06 03:59:08 UTC
Permalink
last post this is just nothing to do with spf

At 02:17 06/05/2012 Sunday, Michael Deutschmann wrote:
>On Sat, 5 May 2012, Alessandro Veseley wrote:
>> > Because the HELO name can be anything, so arranging for an SPF HELO
>> > pass is trivial.
>>
>> You must mean address literals, which are mostly used by MUAs AFAIK.
>
>No, it has nothing to do with [] in addresses.
>
>The problem is that the HELO domain is of no use in determining if an
>incoming MAIL FROM: <> has anything to do with a message you actually
>sent in the past month.

obviously its not spf's job

>gmail.com's MXes and smarthosts are kept within the domain of their
>corporate sponsor, google.com. If gmail.com were ever to issue a bounce,
>it would likely bear a HELO ending in .google.com. So a naive algorithm
>that said "let a purported bounce through if the HELO is SPF-approved and
>is equal to or a subdomain of any domain we have mailed to in the past
>month"

that would be a dumb algorithim, and would fail for 99% of all mail
a chance of working one would be
when sending mail from ***@yourdomain cache domains of all mx's(listed for recipient) (in this case xxxx.google.com)
then accept <> from helo's within those domains (if not spf fail) (spf non-users are allowed to legit bounce too) if going to ***@yourdomain

(better would be to parse the body and see if its a legit ndr (as it should normally include the to/from/ and likely your message-id, there are only about 20-70 MTAs in common use and validating legit bounce pattern from most wouldn't be rocket science)

as anyone at anydomain has their mail go via theirprovidersdomain (both in and out)
(those who point mxX.theirdomain at their providers IP break tls so should learn better and point their mxs at the name their provider uses in helo.theirprovidersdomain)

this is why there are billions of domains, yet relatively few valid helo-identities (one per sending and/or recieving mailserver)

either way if really paranoid about not accepting forged mail from <> use batv its what it was designed for!!!

>Drop the "is equal to or a subdomain" requirement, and any spammer who
>wants to exploit the <> loophole will do so using a HELO domain that he
>fully owns. Then it's trivial for him to engineer a genuine SPF Pass.

and be traceable or on an rbl/dbl

>Thus, for spam control purposes

not spf's job (forgery control is spfs job ONLY)

> it is best to ignore the HELO (aside from
>certain idiot filters), and treat all <> mail as effectively SPF-neutral.

there is vanisingly small amounts of spam with <>

either way its non forged if the helo had valid spf, all non-forged spam gets spf-pass regardless of sender so why would they use <> when they could use ***@spammerdomain and get the same pass

helo pass just shows (with other basic tests like fqrdns etc) that the server IS a server not a bot
(thus killing 98% of connections before looking further) whether mail is from <> or not

if really not happy about bounces, dont send mail
if wanting to authenticate bounces, use batv
if wanting to authenticate bounces but not use batv invent something better (see if anyone uses it)

either way stop trying to make this pet issue spf's fault/responsibility/issue/problem to fix

its way outside the scope of spf, spf deals with allowing senders to publish their sending policy

(no implication is made about whether they even have incoming mail setup for the domain, so why would their bounce acceptance/non-acceptance be added)

i can currently setup ***@do-not-mail-me.com tomorrow and point its mx's at ips with no MTA and publish an spf that allows me to send validly to anyone, spf dosnt say you can reply/bounce or even if the domain is a valid email, this is down to a myriad of other checks/protocols/dnsbl's
(it isn't a valid email if not capable of receiving obviously)

SPF ONLY expresses the domain owners intent as to where he sends from (pass=verified genuine), and whether non-passes are considered outright-forgeries -/possible-forgeries ~/just-non-verified ?

it is not a fix for any other ailments
it sits with all the other basic tests to compliment them
my own servers do 37 separate tests by rcpt-to, sfp for helo & spf for envelope-sender are just 2 and not the most significant by far.
Alessandro Vesely
2012-05-07 11:17:15 UTC
Permalink
On Mon 07/May/2012 10:46:16 +0200 Michael Deutschmann wrote:
> On Sat, 5 May 2012, Alessandro Vesely wrote:
>>> Because the HELO name can be anything, so arranging for an SPF HELO
>>> pass is trivial.
>>
>> You must mean address literals, which are mostly used by MUAs AFAIK.
>
> No, it has nothing to do with [] in addresses.

In any case, address literals are a limit for evaluating HELO.

> The problem is that the HELO domain is of no use in determining if an
> incoming MAIL FROM: <> has anything to do with a message you actually
> sent in the past month.

You seem to imply that messages bearing a null-mailfrom must be
bounces. Actually, it is the opposite way around: bounces must bear a
null-mailfrom.

BTW, during the weekend I run three tests on different samples of
about 25K domains each, counting how many domains reject a "bad"
sender but accept a good one upon a RSET. Reject/accept percentages
result as follows:

reject-on-fail a: 1.11%
reject-on-fail b: 1.21%
reject-null-mailfrom: 0.24%

> gmail.com's MXes and smarthosts are kept within the domain of their
> corporate sponsor, google.com. If gmail.com were ever to issue a bounce,
> it would likely bear a HELO ending in .google.com. So a naive algorithm
> that said "let a purported bounce through if the HELO is SPF-approved and
> is equal to or a subdomain of any domain we have mailed to in the past
> month" would fail badly for at least one major site.
>
> Drop the "is equal to or a subdomain" requirement, and any spammer who
> wants to exploit the <> loophole will do so using a HELO domain that he
> fully owns. Then it's trivial for him to engineer a genuine SPF Pass.

It is equally trivial to engineer such a pass using MFROM.

You have a point there, though. The helo identity is not a 1st class
citizen of any reputation system. Even if it were mail.gmail.com, it
would not be reliable to make guesses at zone cuts. Moreover, as Alan
points out, many helo names are unrelated to the branded domain. For
the tests above, I found about 50% unique MXes/domain;
thus, if outgoing mail flows symmetrically, an helo identity serves
about two domains, on average.
Michael Deutschmann
2012-05-07 11:41:45 UTC
Permalink
On Mon, 7 May 2012, Alessandro Vesely wrote:
> You seem to imply that messages bearing a null-mailfrom must be
> bounces. Actually, it is the opposite way around: bounces must bear a
> null-mailfrom.

Null-mailfrom traffic other than DSNs is insignificant. IMAO, it's ok to
break it.

> > Drop the "is equal to or a subdomain" requirement, and any spammer who
> > wants to exploit the <> loophole will do so using a HELO domain that he
> > fully owns. Then it's trivial for him to engineer a genuine SPF Pass.
>
> It is equally trivial to engineer such a pass using MFROM.

Not if you need to pass a goldlist at the same time.

If the spammer uses a MAIL FROM within a domain he fully controls, he can
pass SPF with flying colors, but gets 5xxed anyway because the goldlist
has never heard of him.

If he uses the MAIL FROM of an actual correspondent of the victim, he
passes the goldlist but now cannot cheese past SPF.

---- Michael Deutschmann <***@talamasca.ocis.net>
Michael Deutschmann
2012-05-04 19:38:24 UTC
Permalink
On Fri, 4 May 2012, Scott Kitterman wrote:
> Spammers to have not adapted to SPF by moving to null mail from's.

It's not an adaptation to SPF, and is indeed counterproductive for the
spammer /at this time/. It's an adaptation to sender address
whitelisting combined with harsh standards to accept non-whitelisted
mail, perhaps to the extreme of goldlisting.

Goldlisting has two chinks in the armor. The first is that the spammer
may guess an e-mail address that the victim corresponds with, and ride on
that person's reputation. The second is that the spammer uses <> and the
sysadmin, refusing to be "RFC-Ignorant", lets it through on the off chance
it might be a genuine bounce.

The first threat doesn't worry me, since we have SPF. Sure, I have
plenty of correspondents with weak/absent SPF policies, but should the
spammer find one, I can apply concentrated pressure to that specific
friend to have his ISP deploy -all. Once that hole is plugged, the
spammer has to start all over.

But I don't see a good "next move" for the good guys if spammers use the
second strategy, other than refusing all putative DSNs. VERP (such as
BATV) doesn't count since, unless a VERP-decoding SPF extension is
adopted, your whitelisting only works if your correspondents don't VERP.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-05-04 20:22:48 UTC
Permalink
At 20:38 04/05/2012 Friday, Michael Deutschmann wrote:
>On Fri, 4 May 2012, Scott Kitterman wrote:
>> Spammers to have not adapted to SPF by moving to null mail from's.
>
>It's not an adaptation to SPF, and is indeed counterproductive for the
>spammer /at this time/. It's an adaptation to sender address
>whitelisting combined with harsh standards to accept non-whitelisted
>mail, perhaps to the extreme of goldlisting.

it dosn't happen and is unlikely to


>Goldlisting has two chinks in the armor. The first is that the spammer
>may guess an e-mail address that the victim corresponds with, and ride on
>that person's reputation. The second is that the spammer uses <> and the
>sysadmin, refusing to be "RFC-Ignorant", lets it through on the off chance
>it might be a genuine bounce.

there are smarter ways to allow someone to goldlist and verify legitimate from bogus bounces
(verp such as batv is the simplest and common among any worried by this possibility)

>The first threat doesn't worry me, since we have SPF. Sure, I have
>plenty of correspondents with weak/absent SPF policies, but should the
>spammer find one, I can apply concentrated pressure to that specific
>friend to have his ISP deploy -all. Once that hole is plugged, the
>spammer has to start all over.
>
>But I don't see a good "next move" for the good guys if spammers use the
>second strategy, other than refusing all putative DSNs.

they wont simply because
A that means they can only spam sender address' (currently they spam receiver address' mainly, receive only address' do and can legitimately block all mail from <> ie sales@ postmaster@ support@)
B at the time this happens (which it won't) it would simply cause people to mass move to verp/batv, thus never again using a receiver-address as a sender

> VERP (such as BATV) doesn't count since, unless a VERP-decoding SPF extension is
>adopted, your whitelisting only works if your correspondents don't VERP.

this has already been shown to be a spurious argument
whitelisting VERP senders is common and easy, or no 'goldlister' could ever subscribe to any mailinglist,
the tech and software to do this has already been trivially implemented widely
simply accept mail from *@whitelinsted-domain at rcpt (assuming spf pass /helo/ptr/dnsbl etc.)
then check for From: Sender: etc containing whitelisted-***@whitelisted-domain at data (and if from non-whitelisted neighbour reject)

really simple (and thats just one way to do it)

spf is not a tool to solve issues that do not yet exist (especially when the proposed solution will do more damage than good)
if spammers start sending en-mass from <> (which usually guarantees the mua can immediately see its not a bounce and spamfolder them)
then another solution will be found, spf is a tool for sender validation, and expression of the senders policy of what should happen to invalidated mails, it has no place for specifying the senders wilingness or unwillingness to receive/refuse bounces, and shouldn't
Michael Deutschmann
2012-05-07 12:30:17 UTC
Permalink
On Fri, 4 May 2012, alan wrote:
> whitelisting VERP senders is common and easy, or no 'goldlister' could
> ever subscribe to any mailinglist,

I wouldn't quite call whitelisting mailinglists a solved problem yet. I
do it, but it's a hack that occasionally fails. The key problem is that
for many mailing lists, including this one, the MAIL FROM: domain of the
distributed messages ("jeeves.archive.listbox.com") is not the same as
that of the submission address ("listbox.com"). The former sometimes
changes abruptly (this list was "v2.listbox.com" before 2007).

> simply accept mail from *@whitelinsted-domain at rcpt (assuming spf
> pass /helo/ptr/dnsbl etc.) then check for From: Sender: etc containing
> whitelisted-***@whitelisted-domain at data (and if from non-whitelisted
> neighbour reject)

That lets too much stuff through to DATA.

True, an expert user with access to logs can recognize VERP and manually
tell his server to demangle the addresses coming from that site. But I
want to aim higher and make whitelisting work for more casual users, by
making the demangling instructions *public*.

> spf is a tool for sender validation, and expression of the senders
> policy of what should happen to invalidated mails, it has no place for
> specifying the senders wilingness or unwillingness to receive/refuse
> bounces, and shouldn't

You're attacking the wrong prong of my fork here. I'm discussing a
proposal to but a flag in SPF records advertising that VERP is in use and
a defined way to decode it. Thus allowing the recipient to obtain the
whitelist lookup key without going to DATA.

(The fork is because we cannot reach agreement on whether deliveries
coming from a site with a "?a -all" SPF record are absolutely
irreversible, not even for quota problems.

If one thinks so (as I do), then a qualifier that says "just as much
confidence the message is unforged as pass, however bounces are still as
unacceptable as if neutral" is needed. It would belong in SPF because it
would be *fixing* an unwanted connotation of regular SPF pass.

If one thinks not (as you, Alan, do), then the qualifier is pointless, but
now we will need VERP, and thus measures to stop VERP from poisoning
whitelisting. This belongs in SPF because SPF depends on whitelisting to
avoid being abused by spammers who generate publish SPF records on their
throwaway domains.)

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-05-07 22:37:08 UTC
Permalink
ok so basically your wanting to add stuff to spf because you want an easier way to do goldlisting
(seems to be the crux here)
so your assuming anyone wanting to talk to your goldlisting implementation will
choose to use your new spf (if they use batv/verp
care to pass your filters

both i think are unlikely, better to design (like the rest of us do) a system that works with ALL current mailers, but works better/faster and with less chance of false positive on those that adopt spf/csv/dkim/etc/etc.

At 13:30 07/05/2012 Monday, Michael Deutschmann wrote:
>On Fri, 4 May 2012, alan wrote:
>> whitelisting VERP senders is common and easy, or no 'goldlister' could
>> ever subscribe to any mailinglist,
>
>I wouldn't quite call whitelisting mailinglists a solved problem yet. I
>do it, but it's a hack that occasionally fails. The key problem is that
>for many mailing lists, including this one, the MAIL FROM: domain of the
>distributed messages ("jeeves.archive.listbox.com") is not the same as
>that of the submission address ("listbox.com"). The former sometimes
>changes abruptly (this list was "v2.listbox.com" before 2007).
>
>> simply accept mail from *@whitelinsted-domain at rcpt (assuming spf
>> pass /helo/ptr/dnsbl etc.) then check for From: Sender: etc containing
>> whitelisted-***@whitelisted-domain at data (and if from non-whitelisted
>> neighbour reject)
>
>That lets too much stuff through to DATA.

if your gold listing you have no choice, you cant 'demand' that 'large-isp-using-batv' start adopting your 'fork' or extension to spf, simply put like spfv1 most just wont (many havn't yet adopted the simple current spf)

>True, an expert user with access to logs can recognize VERP and manually
>tell his server to demangle the addresses coming from that site. But I
>want to aim higher and make whitelisting work for more casual users, by
>making the demangling instructions *public*.
>
>> spf is a tool for sender validation, and expression of the senders
>> policy of what should happen to invalidated mails, it has no place for
>> specifying the senders wilingness or unwillingness to receive/refuse
>> bounces, and shouldn't
>
>You're attacking the wrong prong of my fork here. I'm discussing a
>proposal to but a flag in SPF records advertising that VERP is in use and
>a defined way to decode it. Thus allowing the recipient to obtain the
>whitelist lookup key without going to DATA.

not spf's issue, spf has validated it came from the right ip's to be non-forged (job done)

your goldlisting and resource consumption of same is not spfs issue
(you have to let it goto data to accept from [for example yahoo] as you can only forgery reject them after dkim as they dont use spf at all)

if YOU require a way to pre-data verify the email address of the sender's reply-to or from header
(considering for many forms of batv this cannot be done without access to their servers db/lookup table as their is no simple key)
consider writing your own RFC/Protocol to do so
such as lookup TXT _verpdecode.envelope-sender-domain
for a (to be invented by you) code to decode their reversible verp (if they use a reversible verp)
plus some sort of way for them to signal their verp cant be reversed
plus some way for them to offer a port/server to 'finger' with the encoded address to receive the decoded sender if non reversible


>(The fork is because we cannot reach agreement on whether deliveries
>coming from a site with a "?a -all" SPF record are absolutely
>irreversible, not even for quota problems.

bounces for as i said quota issues (if properly limited) are always acceptable
(ie more so than nether side being informed of the mail dissapearing into the void)

>If one thinks so (as I do), then a qualifier that says "just as much
>confidence the message is unforged as pass, however bounces are still as
>unacceptable as if neutral" is needed. It would belong in SPF because it
>would be *fixing* an unwanted connotation of regular SPF pass.

if your system is bouncing because of later checks that should have been done before the 200 at end of data then yes they are unacceptable/illegitimate and an abuse
just fix the checks to happen before the 200
(regardless of -all ~all ?all or no spf at all)

the corollary of this is that if any system generates legitimate bounces after accepting legitimate un forged mail(due to quota etc) then those bounces should NOT be suppressed due to some unwillingness of the sender to process them, and thus no extension should be made for senders to ask receivers to suppress legitimate bounces.

suppressing legitimate bounces like /dev/nulling mail is bad for all senders and receivers alike

making it possible for receivers to lazily filter (after accepting) but /dev/null NDRs instead of rejecting and having the sender notified is unhealthy for the ecosystem
it also causes dirty senders (who allowed forged mail out) to not generate NDRs (as they dont get a reject) that would otherwise allow the rest of us to track and thus lower their reputations

>If one thinks not (as you, Alan, do), then the qualifier is pointless, but
>now we will need VERP, and thus measures to stop VERP from poisoning
>whitelisting. This belongs in SPF because SPF depends on whitelisting to
>avoid being abused by spammers who generate publish SPF records on their
>throwaway domains.)

spf dosn't rely on whitelisting?
spf is not an anti spam technology
spf is ONLY an anti forgery technology

spammers that publish spf was always expected whitelisting/goldlisting is not the answer, most who do look for an answer simply require sending ips/domains to be on a reputation list (most don't even require spf)

but no one wants spf to become something more than what it is, better/quicker/bug-freer maybe.
Michael Deutschmann
2012-05-09 01:24:21 UTC
Permalink
On Mon, 7 May 2012, alan wrote:
> ok so basically your wanting to add stuff to spf because you want an easier way to do goldlisting
> (seems to be the crux here)
> so your assuming anyone wanting to talk to your goldlisting implementation will
> choose to use your new spf (if they use batv/verp
> care to pass your filters

I'm actually more concerned about the outgoing side of the equation. I
want to keep it easy for other people to whitelist and greylist *me*.

To that end, assuming no reform possible in any protocol, I'd rather be
"RFC-ignorant" and reject <>, than use VERP and tangle up other people's
sorting of my (non-bounce) mail.

But if a standard SPF VERP modifier was added, and there were signs that
greylist and whitelist using recipient sites were listening for it, then
my scales might tip away from rejecting <> and towards VERP....

> (ie more so than nether side being informed of the mail dissapearing
> into the void)

It doesn't have to disappear into the void. The proper way to handle it
is to declare that for handoffs from MX to internal mail store, there is
no such thing as a permanent mail failure. Smarthosts react to a 5xx or
prolonged 4xx by generating a bounce (they can avoid backscatter with
AUTH), but the procedure for an MX should be to place the failed message
in a special hold queue, only flushed by explicit admin action.

When such a 5xx occurs, the MX automatically sets a flag to start 4xxing
everything incoming to the failed destination domain, then alerts its own
admin, who attempts to contact the internal mail store admin to fix the
configuration problem leading to 5xx. When the internal mail store admin
reports the problem is fixed, the MX admin flushes the hold queue, and
then only after that delivery is complete, releases the 4xx flag.

Yes, this does mean the internal admin can be forced to let a mailbox grow
into disk space the actual end user never paid for. My faction of the
conspiracy is aware of this but doesn't care.

A nice side effect of this hard-handed approach is that it blocks the
kind of bounces you agree are unacceptable for free.

Delivery is only truly impossible when the destination address doesn't
actually exist. But failing to detect that problem in-transaction is
just as bad as doing spam filtering late.

---- Michael Deutschmann <***@talamasca.ocis.net>
alan
2012-05-09 17:32:09 UTC
Permalink
At 02:24 09/05/2012 Wednesday, Michael Deutschmann wrote:
>On Mon, 7 May 2012, alan wrote:
>> ok so basically your wanting to add stuff to spf because you want an easier way to do goldlisting
>> (seems to be the crux here)
>> so your assuming anyone wanting to talk to your goldlisting implementation will
>> choose to use your new spf (if they use batv/verp
>> care to pass your filters
>
>I'm actually more concerned about the outgoing side of the equation. I
>want to keep it easy for other people to whitelist and greylist *me*.

well then be assured they will have verp aware sender whitelists if they use such
(or they will fail to receive a significant amount of mail and thus be unused)
(greylisting is a totally different technology and only deals with ips/and retrys)

>To that end, assuming no reform possible in any protocol, I'd rather be
>"RFC-ignorant" and reject <>, than use VERP and tangle up other people's
>sorting of my (non-bounce) mail.

or how bout just accept them and realize that no one is using <> to target you (or anyone else)
(verp is only suggested as a fix IF incoming forged <> becomes a burden)

>But if a standard SPF VERP modifier was added, and there were signs that
>greylist and whitelist using recipient sites were listening for it, then
>my scales might tip away from rejecting <> and towards VERP....

how about as i suggested you dont try and usurp spf for some sort of verp decode protocol
(as said current batv/verp implementations are largely db based and non-trivially reversed)
but instead write/create or convince someone else who equally believes this is useful to write a separate protocol for this
if such a protocol existed then convince batv/verp users to start to use reversible verp

adding such a second protocol (without any thought as to syntax and the myriad ways a decode 'key/algorithim' could be expressed to spf seems like a futile and non-usefull proposal)

as spf provides to reciever's a way to provide
helo+ip > spf > pass fail softfail permerr temperr neutral
mfrom+ip > spf > pass fail softfail permerr temperr neutral

your protocol needs to provide

mfrom > your-protocol > unencoded-sender-address

does this? make it clearer how this is a separate protocol with entirely different inputs/outputs?

>> (ie more so than nether side being informed of the mail dissapearing
>> into the void)
>
>It doesn't have to disappear into the void. The proper way to handle it
>is to declare that for handoffs from MX to internal mail store, there is
>no such thing as a permanent mail failure. Smarthosts react to a 5xx or
>prolonged 4xx by generating a bounce (they can avoid backscatter with
>AUTH), but the procedure for an MX should be to place the failed message
>in a special hold queue, only flushed by explicit admin action.
>
>When such a 5xx occurs, the MX automatically sets a flag to start 4xxing
>everything incoming to the failed destination domain, then alerts its own
>admin, who attempts to contact the internal mail store admin to fix the
>configuration problem leading to 5xx. When the internal mail store admin
>reports the problem is fixed, the MX admin flushes the hold queue, and
>then only after that delivery is complete, releases the 4xx flag.

and how is this 'better' than the standard option of make after internal 5xx generate 1 bounce (as first mail accepted due to cached 2xx) and 5xx all further mail till cleared (due to the same caching)
after internal 4xx , give external 4xx till cleared (if first message accepted due to cached 2xx times out send 1 bounce)
also potentially generate 1 additional bounce every cache expiry and retry

your method seems to rely on a lot of out of protocol and manual intervention.
(which in real world terms means mail broken for days/weeks and neither sender or receiver made aware)
not to mention re-engineering of most current MTA software

subsequent senders are made aware initial one with his message sitting in an un monitored queue is never told

>Yes, this does mean the internal admin can be forced to let a mailbox grow
>into disk space the actual end user never paid for. My faction of the
>conspiracy is aware of this but doesn't care.

with mine this never happens the user just stops receiving mail, all senders are informed in timely fashion with only a tiny amount of bounces (1 per cache cyle, 1 total if callforwards are used), the admin is encouraged instead to delete users who do not clean up their mailboxes if/when full (as inactive users should be removed not just left as dead letter stores)

>A nice side effect of this hard-handed approach is that it blocks the
>kind of bounces you agree are unacceptable for free.

not really as it means those indefinitely queued forgeries either goto a blackhole or more likely result in a manual mail being sent by admin to try and notify the sender (delayed and manually sent from non <>)

>Delivery is only truly impossible when the destination address doesn't
>actually exist. But failing to detect that problem in-transaction is
>just as bad as doing spam filtering late.

err the most common form of mailbox full is admin inaction, (not deleting dead/left/quit/fired/retired employee address')
with current (well setup) systems bounces are the senders first clue, and as already mentioned well setup systems only bounce once (so not an issue for backscatter watchers)

either way a solution like you describe is a total rewrite of software, for this there are already plenty of currently available software solutions for synching mailbox status between frontend and backend (LMTP is designed for this and should be used in these conditions for example)
<http://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol>http://en.wikipedia.org/wiki/Local_Mail_Transfer_Protocol
Wayne Doust
2012-07-03 23:36:26 UTC
Permalink
I perceive a 3-part problem with SPF and SERVFAIL.

1) Most SPF implementations treat any failure in
resolving/retrieving/parsing an SPF record as a TEMPFAIL and issuing
4xx. On the surface, this appears to be a reasonable approach - unless
something in that process is broken....

2) Most mail sysadmins seem to have no idea on how to
manage/tune/control their SPF mechanisms. They simply come bolted on to
a mail filter appliance they own and they check the box that save "SPF
Checking Enabled" and that's the end of the story. They also do not
collect statistics; do no reporting and probably aren't aware of where
(if any) log files are stored. This makes it difficult for them to
resolve issues in part 1.

3) The technical competence of the organisation or ISP seems to be
inversely proportional to its size. This generally means the greater the
effect on your organisation, the more difficult it is to get the remote
organisation to even recognise a problem exists.

Over the past 12 months, I have had five incidences of remote mail
servers rejecting email based on SERVFAIL. The problem has not been our
DNS or our SPF record. It has been the problem of the remote mail server
performing the SPF lookup and failing on "something". In most cases the
other end has not been able to determine the cause and they have simply
chosen to whitelist our domain - which IMO is not a solution and defeats
the purpose of SPF.

One recent case involves a very large ISP in Australia. It has taken
four weeks for them to recognise a problem exists.

That's four weeks of me calling them every day.

I suspect the problem lies in the lesser utilised features of SPF. Our
record adds an IP4 netblock. Another domain has an include statement.
These are the only two domains that have experienced problems with
SERVFAIL. We don't use macros but I wonder how well some of the
implementations will handle that?

IMO, the default and recommended response to an SPF SERVFAIL should be a
NEUTRAL result. Ie treat the domain as if it had no SPF record at all.
This would eliminate issues such as this which can only occur if the
sending domain actually has an SPF record.
********************************************************************************************************
Disclaimer: This email message and any attachments are confidential.
The information contained in this email message and any attachments may be
confidential information. If you are not the intended recipient, any use, interference with,
disclosure or copying of this material is unauthorised and prohibited.
This email and any attachments are also subject to copyright.
No part of them may be reproduced, adapted or transmitted without the written
permission of the copyright owner.
If you have received this email in error please immediately advise the sender
by return email and delete the message from your system.
Although this email has been checked for viruses and other defects, no responsibility
can be accepted for any loss or damage arising from its receipt or use.
Racing Victoria Limited respects your privacy. Our privacy policy can be accessed
from our web site: "http://www.racingvictoria.net.au"
********************************************************************************************************
Scott Kitterman
2012-07-04 00:27:59 UTC
Permalink
On Wednesday, July 04, 2012 09:36:26 AM Wayne Doust wrote:
> I perceive a 3-part problem with SPF and SERVFAIL.
>
> 1) Most SPF implementations treat any failure in
> resolving/retrieving/parsing an SPF record as a TEMPFAIL and issuing
> 4xx. On the surface, this appears to be a reasonable approach - unless
> something in that process is broken....

I used to default temperrors to defer in software I maintain until I saw
problems with exactly this kind of thing. The problem is that there are
actually lots of transient reasons that SERVFAIL can happen, so temperror
actually appears to be the best result code for it (we discussed this in the
IETF SPFbis working group that's chartered to bring SPF from experimental to
standards track and that was the group's conclusion - I forwarded your mail to
them, BTW).

> 2) Most mail sysadmins seem to have no idea on how to
> manage/tune/control their SPF mechanisms. They simply come bolted on to
> a mail filter appliance they own and they check the box that save "SPF
> Checking Enabled" and that's the end of the story. They also do not
> collect statistics; do no reporting and probably aren't aware of where
> (if any) log files are stored. This makes it difficult for them to
> resolve issues in part 1.
>
> 3) The technical competence of the organisation or ISP seems to be
> inversely proportional to its size. This generally means the greater the
> effect on your organisation, the more difficult it is to get the remote
> organisation to even recognise a problem exists.
>
> Over the past 12 months, I have had five incidences of remote mail
> servers rejecting email based on SERVFAIL. The problem has not been our
> DNS or our SPF record. It has been the problem of the remote mail server
> performing the SPF lookup and failing on "something". In most cases the
> other end has not been able to determine the cause and they have simply
> chosen to whitelist our domain - which IMO is not a solution and defeats
> the purpose of SPF.
>
> One recent case involves a very large ISP in Australia. It has taken
> four weeks for them to recognise a problem exists.
>
> That's four weeks of me calling them every day.
>
> I suspect the problem lies in the lesser utilised features of SPF. Our
> record adds an IP4 netblock. Another domain has an include statement.
> These are the only two domains that have experienced problems with
> SERVFAIL. We don't use macros but I wonder how well some of the
> implementations will handle that?
>
> IMO, the default and recommended response to an SPF SERVFAIL should be a
> NEUTRAL result. Ie treat the domain as if it had no SPF record at all.
> This would eliminate issues such as this which can only occur if the
> sending domain actually has an SPF record.

I see your record as "v=spf1 ip4:202.168.6.0/24 mx ptr ~all". It's probably
the ptr mechanism that is the source of your problem. rDNS lookups can be
quite problematic and it's possible to construct any SPF record you need
without resort to it. We've marked the ptr mechanism as "deprecated" and
recommended people not use it in the RFC 4408bis draft we have in progress.

I suspect that without ptr, you'd be fine. If there are authorized mail
servers for your domain that aren't covered by ip4:202.168.6.0/24 mx, add them
and then remove ptr. If, as I suspect (because it's common), you added ptr
just because a wizard of some sort suggested it, just remove it.

Scott K
alan
2012-07-04 02:24:16 UTC
Permalink
>I see your record as "v=spf1 ip4:202.168.6.0/24 mx ptr ~all". It's probably
>the ptr mechanism that is the source of your problem. rDNS lookups can be
>quite problematic and it's possible to construct any SPF record you need
>without resort to it. We've marked the ptr mechanism as "deprecated" and
>recommended people not use it in the RFC 4408bis draft we have in progress.

equally mx is a pretty useless addition to spf as its 1+number of mxs in cost in your case 1 mx so cost=2
using a:bareed.racingvictoria.net.au on the other hand costs 1 dns lookup (and one less chance of fail)

and as this server has 2 ips (and is in the same domain thus any change in its ip you already controll)
replacing it with
ip4:203.58.18.232 ip4:202.168.6.132 0 cost and 0 chance of servfail
and as one of these ips is in your class c changing your spf from
"v=spf1 ip4:202.168.6.0/24 cost 0
mx cost 2
ptr cost 2(minimum)
~all"

to "v=spf1 ip4:202.168.6.0/24 ip4:203.58.18.232 ~all" cost 0 chance of servfail 0
with no actual change in function
Michael Deutschmann
2012-07-17 01:10:38 UTC
Permalink
(This is my third attempt to post this particular message. The previous
two were mysteriously blackholed -- my mail logs show normal delivery to
mx-1.listbox.com and yet they have never appeared in the archives or been
returned to me. Two posts by other people have appeared in the meantime,
so the list as a whole doesn't appear to be dead.

One longshot theory is that my original draft may have been spam-filtered
because I quoted the mail-from of a message I'm pretty sure was a phish.
So I'm making one more try with that address redacted.)

On Wed, 4 Jul 2012, Wayne Doust wrote:
> They also do not collect statistics; do no reporting and probably
> aren't aware of where (if any) log files are stored. This makes it
> difficult for them to resolve issues in part 1.

I do review my own logs every month, but I probably wouldn't notice the
sort of issue you complain about, for the simple reason that I already
accept hundreds of SPF-related 4xx's per month as *baseline noise*.

They appear to be mostly actual spam/phish/etc. (I only see the MAIL
FROM:, but surprisingly often that's enough to tell. Eg: 185 attempts
allegedly from [redacted] last April - a bank in a
foreign country.) The reason for the deferral is usually that the DNS
server of the purported sender domain barfs on Type 99 record lookups.

---- Michael Deutschmann <***@talamasca.ocis.net>
Continue reading on narkive:
Loading...