Subject: RE: [Asrg] 0. General - Administrative - for M. Wild

From: "Bob Atkinson" <[email-masked]>
Date: Fri, 29 Aug 2003 10:38:15 -0700

There's a much simpler reason why rDNS is unreliable.

In order for rDNS to work, the domain owner must have a DNS relationship
with their ISP (as opposed to hosting DNS themselves). There are many,
particularly the small folk, who do not, esp. as it costs ongoing $ to
maintain such a relationship. 

Having such a relationship is not today pragmatically necessary to
participate in the Internet, and we ought to think carefully before
giving ISPs such a win-fall and shift in power. 

	Bob

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
Hector Santos
Sent: Thursday, August 28, 2003 12:34 PM
To: Anti-Spam
Subject: Re: [Asrg] 0. General - Administrative - for M. Wild

David,

We found rDNS checking on HELO/EHLO to be unreliable due to
mis-configuration of smtp servers, in particular those systems who
prepare a
send-only or routing server,  which from my last reading of the RFC (a
few
years back), need to be prepare as sub-domains.   Because they are not,
it
is not possible to do reliable checking.

Recently, we added logic to check for the bracket DOT format,  i.e,.
HELO/EHLO [X.X.X.X]

We found those servers using this format to be spammer servers and they
are
using it incorrectly, providing the literal IP without the brackets,
i..e,
HELO/EHLO X.X.X.X

So we reject the HELO/ELHO state when

a) The literal IP does not have brackets, or
b) The provided bracket IP does not match the connecting peer IP.

We have rejected on average about 125 per day using this scheme.

Incidentally, before this logic was added,  the average about 80
attempts
per day.  Hence, the rejection is causing some senders to try again more
often.  We are sending a 5XX response code (permanent error, don't try
again) but some are ignoring it of course. :-)

----

Hector Santos
WINSERVER "Wildcat! Interactive Net Server"
http://www.santronics.com

----- Original Message ----- 
From: "David Wilson" <[email-masked]>
To: "Yakov Shafranovich" <[email-masked]>
Cc: <[email-masked]>
Sent: Thursday, August 28, 2003 4:00 AM
Subject: Re: [Asrg] 0. General - Administrative - for M. Wild

> On Wed, 2003-08-27 at 14:24, Yakov Shafranovich wrote:
> > This message is intended for M Wild ("Mike"):
> >
> > I have been trying to send an email reply to you but unfortunately
it is
> > not going through due to the following error:
> >
> > 450 Client host rejected: cannot find your hostname, [xx.xx.xx.xx]
> >
> > I do not have an rDNS address and use the IP address in the HELO
command
> > for SMTP. Apparently your server is not accepting that. Please let
me
know
> > an alternative way to contact you.
>
> RFC 2822 specifically allows domain literals in the EHLO/HELO command.
>
> RFC 1123 Section 5.2.5 specific forbids refusing messages if the
domain
> name in HELO (predating SMTP extensions, there is no mention of EHLO)
> "fails verification".
>
> There was general discussion some years ago about the issue of:
>
> - accepting SMTP connections when there is no rDNS for the calling IP
> address.
>
> - accepting SMTP connections if the rDNS hostname does not have an A
> record which contains the calling IP address.
>
> At that stage there were enough legitimate sites which fail either of
> these tests to make rejection on these grounds unacceptable for a
> reasonable service.
>
> So, in my opinion M Wild's MTA is not acting reasonably.
>
> cheers
>
> David Wilson                             [email-masked]
> Isode Limited                            Tel: +44 (0) 20 8783 2961
> http://www.isode.com
>
>
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
>
>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 29 Aug 2003 15:03:25 -0400

So what should we suggest as part of the BCPs?

---

From: Steven F Siirila <[email-masked]>
Date: Fri, 29 Aug 2003 14:22:14 -0500

Until we require both rDNS -AND- add another DNS identifier declaring the
sending MTA as an MTA, we will continue to see trojan software masquerading
as MTAs.  While it may be a slow, painful process, I don't see any good
alternatives (at least not in our environment).  We continue to employ
rDNS checking, adding more networks to the mix all the time.  The key to
implementing rDNS for us has been:

 1) It is not done for all IP addresses, but rather on a per-netblock basis
    (with the count of addresses having this requirement increasing each day)

 2) Users can opt-out of this requirement (the blocking occurs after
    RCPT TO processing)

 3) Even with the blocking in place, we return a URL to the sender to
    allow them to request a block exception from our user who can then
    either grant, deny, or ignore the request

-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: [email-masked]
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota

---

From: Richard Rognlie <[email-masked]>
Date: Fri, 29 Aug 2003 22:49:11 -0400

> giving ISPs such a win-fall and shift in power. 

The DRIP structure is rDNS-ish, but not dependent on you getting your
provider to cooperate.

that said...   my understanding of getting rDNS working in a mail
context, the rDNS is a PTR to an A record (not necessarily one you 
control).  As long as that A record also points to the same IP...
you're golden.

so, I might use foo.bar.com as my EHLO line.  And in fact,
the A for foo.bar.com points to xx.yy.zz.tt.

but when they look up tt.zz.yy.xx.in-addr.arpa, they'll get whatever
my ISP sez it is.  say

    rdsl-xx-yy-zz-tt.joesisp.com

as long as *that* resolves to xx.yy.zz.tt (as one of its A records)
the MTA should not complain.  In fact, that's what sendmail does.

If the result of the rDNS lookup (and forward lookup) do NOT match,
it tacks on "may be forged" to the Received: header.

-- 
 /  \__  | Richard Rognlie / Oracle Prophet / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/rrognlie/    <[email-masked]>
 /  \__/ | I can only please 1 person per day.  Today is not your day.
 \__/    | Tomorrow doesn't look good either.

---

From: Brad Knowles <[email-masked]>
Date: Sat, 30 Aug 2003 17:44:54 +0200

>  So what should we suggest as part of the BCPs?

	I believe that we should document the kinds of things that could 
be done, discuss the advantages and disadvantages of each method, and 
then make some recommendations towards the end.

	However, I believe that any set of recommendations would have to 
include the strongly encouraged use of a multivariate scoring system, 
such as currently used today in tools like SpamAssasin, plus 
recommendations for relative values for each of the criteria to be 
judged.

	But that's just my personal view.  I am a strong proponent of 
basing things like this on consensus, and we would have to see what 
the other members of the BCP subgroup have to say.

-- 
Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)