Subject: [Asrg] 0. General - For Hector Santos

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 18:11:07 -0500

Your system is rejecting my mail, this is not the first time this happened.

Yakov

-------- Original Message --------
Subject: Delivery Notification: Delivery has failed
Date: Thu, 18 Dec 2003 23:08:43 +0000 (GMT)
From: Internet Mail Delivery <[email-masked]>
To: [email-masked]

This report relates to a message you sent with the following header fields:

   Return-path: <[email-masked]>
   Received: from tcp-daemon.dedicated60-bos.wh.sprintip.net by
    dedicated60-bos.wh.sprintip.net
    (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
    id <[email-masked]>
    (original mail from [email-masked]); Thu,
    18 Dec 2003 23:08:43 +0000 (GMT)
   Received: from solidmatrix.com (000-375-685.area3.spcsdns.net 
[68.29.181.209])
    by dedicated60-bos.wh.sprintip.net
    (iPlanet Messaging Server 5.2 HotFix 1.16 (built May 14 2003))
    with ESMTPA id <[email-masked]> for
    [email-masked]; Thu, 18 Dec 2003 23:07:57 +0000 (GMT)
   Date: Thu, 18 Dec 2003 18:07:59 -0500
   From: Yakov Shafranovich <[email-masked]>
   Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?
   In-reply-to: <000d01c3c5ba$1a8b94d0$6401a8c0@FAMILY>
   Sender: [email-masked]
   To: Hector Santos <[email-masked]>
   Cc: [email-masked]
   Message-id: <[email-masked]>
   Organization: SolidMatrix Technologies, Inc.
   MIME-version: 1.0
   Content-type: text/plain; charset=us-ascii; format=flowed
   Content-transfer-encoding: 7BIT
   X-Accept-Language: en-us, en, he, ru
   User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.5)
    Gecko/20031007
   X-Enigmail-Version: 0.82.2.0
   X-Enigmail-Supports: pgp-inline, pgp-mime
   References: <[email-masked]>
    <[email-masked]>
    <[email-masked]> <20031218222423.GB17431@mail>
    <000d01c3c5ba$1a8b94d0$6401a8c0@FAMILY>

Your message cannot be delivered to the following recipients:

   Recipient address: [email-masked]
   Reason: SMTP transmission failure has occurred
   Diagnostic code: smtp;554 Message Not Accepted by filter.
   Remote system: dns;mail.winserver.com (winserver.com Wildcat! ESMTP 
Server v5.7.450.9b10 ready)

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"Among all our enemies / The ones to be most feared are often the 
smallest" (Jean de la Fontaine)
-------

Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?
From: Yakov Shafranovich <[email-masked]>
To: Hector Santos <[email-masked]>
Cc: [email-masked]
Date: Thu, 18 Dec 2003 18:07:59 -0500

Hector Santos wrote:
> I would be on the side that after you after you given the right the
> send, it would be the professional and ethical duty of the
> "messenger" to deliver it.    That is where ECPA issues may arise and
> now CAN-SPAM regardless what Section 8 says.  CAN-SPAM may not change
> the fact that policy issues may prevail, the fact is ONCE you do
> accept a message, you can't just get like it go into the LA-LA land
> without a policy reason.
> 
> People better start waking up to the reality that CAN-SPAM will give 
> SPAMMERS the "right" to send as long as they follow the rules and
> law.    If you don't think they will use this in their favor in
> situations where ISPs and sites are "blocking" them,  then be ready
> for a rude awakening.  If the SPAMMER has a "conceptual contract"
> with the user and you being to block this mail when they did
> everything in the rule books,  look out for fan debris.
> 

This is a legal issue, and we are not lawyers. What exactly this law 
will do is subject to debate by LAWYERS, not engineers. From the ASRG 
charter (http://www.irtf.org/charters/asrg.html):

"ASRG will not pursue research into legal issues of spam, other than
the extent to which these issues affect, support, or constrain the
technology."

This topic is out of scope for the ASRG.

> The IETF best get on the bandwagon to get the specifications cleared
> up and begin to make them consistent with the law ASAP, not 18 months
> from now.
> 

Since the IAB is the liason for the entire IETF, this is something to be 
taken up with them or on the main IETF list. From the IAB charter (RFC 
2850):

"2.  The Role of the IAB
...
   (f) External Liaison

    The IAB acts as representative of the interests of the IETF and the
    Internet Society in technical liaison relationships with other
    organizations concerned with standards and other technical and
    organizational issues relevant to the world-wide Internet.
"

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
  "Why are both drug addicts and computer aficionados both called 
users?" (Clifford Stoll)
-------

---

From: Philip Miller <[email-masked]>
Date: Thu, 18 Dec 2003 18:17:57 -0500

> Your system is rejecting my mail, this is not the first time this happened.

Mine as well. It's attached.

Philip Miller

Subject: Returned mail: delivery problems encountered
From: Mail Delivery Subsystem <[email-masked]>
To: <[email-masked]>
Date: 18 Dec 2003 23:10:24 +0000

A message (from <[email-masked]>) was received at 18 Dec 2003 23:10:09 +0000.

The following addresses had delivery problems:

<[email-masked]>
	Permanent Failure: Other address status
	Delivery last attempted at Thu, 18 Dec 2003 23:10:23 -0000

Subject: Re: [Asrg] 6. Proposals: MTA MARK vs port 25 filtering?
From: Philip Miller <[email-masked]>
To: Hector Santos <[email-masked]>
Cc: [email-masked]
Date: Thu, 18 Dec 2003 18:10:46 -0500

Hector Santos wrote:
> I would be on the side that after you after you given the right the send,
> it would be the professional and ethical duty of the "messenger" to deliver
> it.    That is where ECPA issues may arise and now CAN-SPAM regardless what
> Section 8 says.  CAN-SPAM may not change the fact that policy issues may
> prevail, the fact is ONCE you do accept a message, you can't just get like
> it go into the LA-LA land without a policy reason.
> 
> SPAMMERS the "right" to send as long as they follow the rules and law.    If
> you don't think they will use this in their favor in situations where ISPs
> and sites are "blocking" them,  then be ready for a rude awakening.  If the
> SPAMMER has a "conceptual contract" with the user and you being to block
> this mail when they did everything in the rule books,  look out for fan
> debris.

No, it doesn't. This has been stated before on this list. CAN-SPAM allows 
any service provider to block messages for any policy reason. It only 
defines what senders CAN NOT legally do.

> The IETF best get on the bandwagon to get the specifications cleared up and
> begin to make them consistent with the law ASAP, not 18 months from now.

They are perfectly consistent with the law. The law says recipient servers 
can do whatever they want with local policy, the RFCs say recipient servers 
can do whatever they want with local policy.

CAN-SPAM 'compliance' is purely the burden of senders of commercial email. 
There is nothing in it which says that recipient servers can, cannot, 
should, or should not enforce the requirements placed on senders.
CAN-SPAM requires a valid return path in all commercial email. It does NOT 
require that recipient servers accept all commercial email so long as it has 
a valid return path.

Philip Miller

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 18:41:37 -0500

----- Original Message ----- 
From: "Philip Miller" <[email-masked]>
To: "ASRG" <[email-masked]>
Sent: Thursday, December 18, 2003 6:17 PM
Subject: Re: [Asrg] 0. General - For Hector Santos

> Mine as well. It's attached.

Well lets see:

A message (from <[email-masked]>) was received at 18 Dec 2003 23:10:09
+0000.

Useless information..  Lets look further.  Here is your session:

**************************************************************************
Wildcat! SMTP Server v5.7.450.9b10
SMTP log started at Thu, 18 Dec 2003  18:10:54
Connection Time  : 20031218 18:10:51
Client IP Address: 204.127.198.39 (unknown)
SSL Enabled: NO
18:10:54 S: 220 winserver.com Wildcat! ESMTP Server v5.7.450.9b10 ready
18:10:54 C: EHLO rwcrmhc13.comcast.net
18:10:54 S: 250-winserver.com, Pleased to meet you.
18:10:54 S: 250-SIZE 5120000
18:10:54 S: 250-ETRN
18:10:54 S: 250-AUTH CRAM-MD5 LOGIN PLAIN PLAIN-MD5 SHA-1
18:10:54 S: 250-AUTH=LOGIN
18:10:54 S: 250 HELP
18:10:54 C: MAIL FROM:<[email-masked]> SIZE=2960
18:11:04 ** WCX Process: wcsap  ret: 552
18:11:04 S: 552 Return Path not verifiable!
18:11:04 C: RSET
18:11:04 S: 250 Reset State
18:11:05 C: QUIT
18:11:05 S: 221 closing connection

Your path was not verifier. Now lets look at WCSAP log:

20031218 18:10:54 0001ac00 -------------------------------------
20031218 18:10:54 0001ac00 version: 1.42 / 1.36
20031218 18:10:54 0001ac00 cmd    : MAIL FROM
20031218 18:10:54 0001ac00 method : WCSAP
20031218 18:10:54 0001ac00 uid    : 0
20031218 18:10:54 0001ac00 ip     : 204.127.198.39
20031218 18:10:54 0001ac00 cdn    : rwcrmhc13.comcast.net
20031218 18:10:54 0001ac00 hdn    :
20031218 18:10:54 0001ac00 rbl    : 0
20031218 18:10:54 0001ac00 relay  : 0
20031218 18:10:54 0001ac00 from   : <[email-masked]>
20031218 18:10:54 0001ac00 filter : test
20031218 18:10:54 0001ac00 result : 0
20031218 18:11:04 0001ac00 no ptr record - rejected
20031218 18:11:04 0001ac00 SMTP response code: 552
20031218 18:11:04 0001ac00 wcsap finish
20031218 18:12:05 0001ac01 -------------------------------------

Sorry, NO PTR RECORD FOR ZEMOS.NET

You ain't GETTING IN! PERIOD!

As for Yakov,  lets do a search... What address are you using?  You and I
have been sending mail back and forth with SolidMatrix.net  Here is a SAP
log at 18:09:

20031218 18:09:23 0001abff -------------------------------------
20031218 18:09:23 0001abff version: 1.42 / 1.36
20031218 18:09:23 0001abff cmd    : MAIL FROM
20031218 18:09:23 0001abff method : WCSAP
20031218 18:09:23 0001abff uid    : 0
20031218 18:09:23 0001abff ip     : 63.167.114.16
20031218 18:09:23 0001abff cdn    : dedicated60-bos.wh.sprintip.net
20031218 18:09:23 0001abff hdn    :
20031218 18:09:23 0001abff rbl    : 0
20031218 18:09:23 0001abff relay  : 0
20031218 18:09:23 0001abff from   : <[email-masked]>
20031218 18:09:23 0001abff filter : test
20031218 18:09:23 0001abff result : 0
20031218 18:09:23 0001abff total mx records: 1
20031218 18:09:23 0001abff trying mx: solidmatrix.com ip: 64.90.180.93
20031218 18:09:23 0001abff # connecting to 64.90.180.93
20031218 18:09:23 0001abff S: 220 std5.imagineis.com ESMTP Sendmail
8.12.8/8.12.8; Thu, 18 Dec 2003 18:08:40 -0500
20031218 18:09:23 0001abff C: NOOP WCSAP v1.42 Wildcat! Sender
Authentication Protocol http://www.santronics.com
20031218 18:09:23 0001abff S: 250 2.0.0 OK
20031218 18:09:23 0001abff C: HELO mail.winserver.com
20031218 18:09:23 0001abff S: 250 std5.imagineis.com Hello
ntbbs.winserver.com [208.247.131.9], pleased to meet you
20031218 18:09:23 0001abff C: MAIL FROM: <>
20031218 18:09:23 0001abff S: 250 2.1.0 <>... Sender ok
20031218 18:09:23 0001abff C: RCPT TO: <[email-masked]>
20031218 18:09:23 0001abff S: 250 2.1.5 <[email-masked]>...
Recipient ok
20031218 18:09:23 0001abff C: RCPT TO:
<[email-masked]>
20031218 18:09:24 0001abff S: 550 5.7.1
<[email-masked]>... Relaying denied. Proper
authentication required.
20031218 18:09:24 0001abff C: QUIT
20031218 18:09:24 0001abff result : 250
20031218 18:09:24 0001abff wcsap finish

Perfect, a 250 response code!

Lets do a solidmatrix.com lookup for the entire month and see if there are
any errors.

E:\wcsap\logs>grep -li solidmatrix wcsap200312*.log
File wcsap20031201.log:
File wcsap20031202.log:
File wcsap20031203.log:
File wcsap20031204.log:
File wcsap20031205.log:
File wcsap20031207.log:
File wcsap20031208.log:
File wcsap20031209.log:
File wcsap20031212.log:
File wcsap20031213.log:
File wcsap20031216.log:

I just did a detail look at each of the above date logs.

Dec 1,   1 successful message from you
Dec 2,   1 successful message from you
Dec 3,   2 successful messages from you
Dec 4,   3 successful messages from you
Dec 5,   3 successful messages from you
Dec 7,   1 successful message from you
Dec 8,   2 successful messages from you
Dec 9,   1 successful messages from you
Dec 12,   2 successful messages from you
Dec 13,   2 successful messages from you
Dec 16,   0 successful messages from you

But on the 16th, I see I did a test to [email-masked]  using the
WEB SERVICE mode of WCSAP!

20031216 06:22 00018d71 -------------------------------------
20031216 06:22 00018d71 version: 1.36 / 1.36
20031216 06:22 00018d71 uid    : 0
20031216 06:22 00018d71 ip     : LocalHost
20031216 06:22 00018d71 cdn    :
20031216 06:22 00018d71 from   : [email-masked]
20031216 06:22 00018d71 rbl    : 0
20031216 06:22 00018d71 relay  : 0
20031216 06:22 00018d71 hdn    :
20031216 06:22 00018d71 trying mx: solidmatrix.com ip: 64.90.180.93
20031216 06:22 00018d71 # connecting to 64.90.180.93
20031216 06:22 00018d71 S: 220 std5.imagineis.com ESMTP Sendmail
8.12.8/8.12.8; Tue, 16 Dec 2003 06:21:34 -0500
20031216 06:22 00018d71 C: HELO mail.winserver.com
20031216 06:22 00018d71 S: 250 std5.imagineis.com Hello ntbbs.winserver.com
[208.247.131.9], pleased to meet you
20031216 06:22 00018d71 C: MAIL FROM: <>
20031216 06:22 00018d71 S: 250 2.1.0 <>... Sender ok
20031216 06:22 00018d71 C: RCPT TO: <[email-masked]>
20031216 06:22 00018d71 S: 550 5.1.1 <[email-masked]>... User
unknown
20031216 06:22 00018d71 C: QUIT
20031216 06:22 00018d71 result : 550
20031216 06:22 00018d71 SMTP response code: 552
20031216 06:22 00018d71 wcsap finish

Sorry Yakov,  I checked every log and not one FAILURE to receive.   If you
want to show me your END of the log then maybe we can match it.

Now back to Phillip........

- Hector

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 19 Dec 2003 00:52:22 +0100

> You ain't GETTING IN! PERIOD!

Just out of curiosity.
What would you expect a "PTR record for ZEMOS.NET" to look like?

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 19:39:29 -0500

A domain name pointer record?

Lets use NT's NSLOOKUP:

WC5 L:\wc5>nslookup -querytype=ptr zemos.net
Server:  ns.santronics.com
Address:  208.247.131.10

*** No domain name pointer (PTR) records available for zemos.net

WC5 L:\wc5>nslookup -querytype=cname zemos.net
Server:  ns.santronics.com
Address:  208.247.131.10

*** No canonical name (CNAME) records available for zemos.net

WC5 L:\wc5>nslookup -querytype=mx zemos.net
Server:  ns.santronics.com
Address:  208.247.131.10

Non-authoritative answer:
zemos.net       MX preference = 40, mail exchanger = coda.club.cc.cmu.edu
zemos.net       MX preference = 0, mail exchanger = cia.zemos.net
zemos.net       MX preference = 20, mail exchanger = fda.zemos.net
zemos.net       MX preference = 30, mail exchanger = mike.zemos.net

coda.club.cc.cmu.edu    internet address = 128.2.4.166
cia.zemos.net   internet address = 64.203.5.232
fda.zemos.net   internet address = 68.38.12.170
mike.zemos.net  internet address = 12.226.225.174

Let me test it with our DNS MX resolver in our code::

D:\local\wc5\wcsmtp\wcdns>testwcdns zemos.net
-- [zemos.net] --
0   | 64.203.5.232         | zemos.net | cia.zemos.net
20  | 68.38.12.170         | zemos.net | fda.zemos.net
30  | 12.226.225.174       | zemos.net | mike.zemos.net
40  | 128.2.4.166          | zemos.net | coda.club.cc.cmu.edu

Its working now!!!    Lets do: a manual WCSAP run

d:\wc5beta>wcrun -r wcsap
"&debug=1&from=<[email-masked]>&ip=204.127.198.39"

20031218 19:25:28 000000c0 -------------------------------------
20031218 19:25:28 000000c0 version: 1.42 / 1.42
20031218 19:25:28 000000c0 method : WCSAP
20031218 19:25:28 000000c0 ip     : 204.127.198.39
20031218 19:25:28 000000c0 from   : <[email-masked]>
20031218 19:25:28 000000c0 filter : test
20031218 19:25:28 000000c0 result : 0
20031218 19:25:28 000000c0 total mx records: 4
20031218 19:25:28 000000c0 trying mx: cia.zemos.net ip: 64.203.5.232
20031218 19:25:28 000000c0 # connecting to 64.203.5.232
20031218 19:25:29 000000c0 S: 220 cia.zemos.net SMTP DAEMON
20031218 19:25:29 000000c0 C: NOOP WCSAP v1.42 Wildcat! Sender
Authentication Protocol http://www.santronics.com
20031218 19:25:29 000000c0 S: 250 Ok
20031218 19:25:29 000000c0 C: HELO localhost
20031218 19:25:29 000000c0 S: 250 cia.zemos.net
20031218 19:25:29 000000c0 C: MAIL FROM: <>
20031218 19:25:29 000000c0 S: 250 Ok
20031218 19:25:29 000000c0 C: RCPT TO: <[email-masked]>
20031218 19:25:29 000000c0 S: 250 Ok
20031218 19:25:29 000000c0 C: RCPT TO:
<[email-masked]>
20031218 19:25:34 000000c0 S: 554
<[email-masked]>: Recipient address rejected:
Relay access denied
20031218 19:25:34 000000c0 C: QUIT
20031218 19:25:34 000000c0 result : 250
20031218 19:25:34 000000c0 wcsap finish (6339 msecs)

Workng great.

Can't explain other than it looks like someone updated their system!
Maybe my network DNS at HQ has a problem.   lets run it from the production
site:

L:\wc5>wcrun -r wcsap "&debug=1&from=<[email-masked]>&ip=204.127.198.39"

20031218 19:29:06 0001acc1 -------------------------------------
20031218 19:29:06 0001acc1 version: 1.42 / 1.42
20031218 19:29:06 0001acc1 cmd    : MAIL FROM
20031218 19:29:06 0001acc1 method : WCSAP
20031218 19:29:06 0001acc1 uid    : 0
20031218 19:29:06 0001acc1 ip     : 204.127.198.39
20031218 19:29:06 0001acc1 cdn    :
20031218 19:29:06 0001acc1 hdn    :
20031218 19:29:06 0001acc1 rbl    : 0
20031218 19:29:06 0001acc1 relay  : 0
20031218 19:29:06 0001acc1 from   : <[email-masked]>
20031218 19:29:06 0001acc1 filter : test
20031218 19:29:06 0001acc1 result : 0
20031218 19:29:06 0001acc1 total mx records: 4
20031218 19:29:06 0001acc1 trying mx: cia.zemos.net ip: 64.203.5.232
20031218 19:29:06 0001acc1 # connecting to 64.203.5.232
20031218 19:29:07 0001acc1 S: 220 cia.zemos.net SMTP DAEMON
20031218 19:29:07 0001acc1 C: NOOP WCSAP v1.42 Wildcat! Sender
Authentication Protocol http://www.santronics.com
20031218 19:29:07 0001acc1 S: 250 Ok
20031218 19:29:07 0001acc1 C: HELO mail.winserver.com
20031218 19:29:07 0001acc1 S: 250 cia.zemos.net
20031218 19:29:07 0001acc1 C: MAIL FROM: <>
20031218 19:29:07 0001acc1 S: 250 Ok
20031218 19:29:11 0001acc1 C: RCPT TO: <[email-masked]>
20031218 19:29:11 0001acc1 S: 250 Ok
20031218 19:29:11 0001acc1 C: RCPT TO:
<[email-masked]>
20031218 19:29:16 0001acc1 S: 554
<[email-masked]>: Recipient address rejected:
Relay access denied
20031218 19:29:16 0001acc1 C: QUIT
20031218 19:29:16 0001acc1 result : 250
20031218 19:29:16 0001acc1 wcsap finish

No problem.   Oh well! <g>

-- Hector

---

From: Markus Stumpf <[email-masked]>
Date: Fri, 19 Dec 2003 01:47:20 +0100

> A domain name pointer record?

And what would that be?

> *** No domain name pointer (PTR) records available for zemos.net

What you are doing here is nonsense.
PTR records do the mapping from IP addresses to hostnames. I.e. you get
a connection from 195.30.0.8 then you lookup the PTR record for
    8.0.30.195.in-addr.arpa
and you get   mail.space.net.
A PTR record can be thought of as the reverse of an A(ddress) record.

moebius2.space.net(1:4725) $ nslookup -querytype=ptr winserver.com
Server:  ns2.Space.Net
Address:  195.30.0.2
*** No domain name pointer (PTR) records available for winserver.com

So you expect others to have records that you don't have yourself?

	\Maex

---

From: Philip Miller <[email-masked]>
Date: Thu, 18 Dec 2003 20:14:16 -0500

> Useless information..  Lets look further.  Here is your session:

Looking at this log, something is unclear to me. Are you connecting to the 
comcast.net server that's connected to you, or are you connecting to a 
query-returned MX for zemos.net? Your manual tests in your later response to 
Markus indicate that you're checking against zemos.net, but that's not 
explicit here. In fact, I see no mention of zemos.net in the WSCAP log other 
than in my address.
What exact DNS queries are you making, what connections are you opening, and 
what commands are you sending? I'm not about to tell all of the other 
zemos.net MX operators to log SMTP transactions to debug your broken 
software. If you're connecting to the comcast.net server in an attempt to 
verify the return path, that's WRONG! If it accepted mail for zemos.net, it 
would be an open relay.

Philip Miller

P.S.: There is 1 'L' in my given name.

---

From: Philip Miller <[email-masked]>
Date: Thu, 18 Dec 2003 20:29:32 -0500

Hector,
Could you publish the exact algorithm your software is currently using to do 
return-path verification? Hopefully, this isn't some sort of trade secret. 
Publishing this would make it much clearer to us what exactly it's testing, 
as I don't recall you're ever said that explicitly.

Thanks,
Philip Miller

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 20:25:28 -0500

Hector Santos wrote:
> First thing first, what  is nonsense is to first CORRECT your god damn
> BLACKLIST and remove our ADDRESS from that RBL list!
> 

Keep it civilized folks.

Yakov

-------
Yakov Shafranovich / asrg <at> shaftek.org
SolidMatrix Technologies, Inc. / research <at> solidmatrix.com
"But in this world nothing can be said to be certain, except death and 
taxes" (Benjamin Franklin)
-------

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 20:44:32 -0500

----- Original Message ----- 
> explicit here. In fact, I see no mention of zemos.net in the WSCAP log
other

Good point. I'll make sure its logged better.    The PTR logging was
incorrect. I copied some PTR lookup (not used yet) logging code.  It was an
DNS MX lookup error that was returned. It a NX_DOMAIN DNS error (non
existent domain).   I can't explain why it happen that one time, but it
seems ok now.  I think it might have been a timeout.   As you can see there
was a 10 second delay in the response.   I need to increase this timeout.
That will resolve it.

> software.

Oh, and you think you can write better software than I?   What have you out
there?   Don't get go buddy.

>  If you're connecting to the comcast.net server in an attempt to

Look,  the DOMAIN PART of your return address, ZEMOS..NET is used for the
verification.  Thats obvious ok?

rwcrmhc13.comcast.net is the client domain provided by your MTA at the
HELO/EHLO state.  It is just logged in wcSAP and will be used in the future
when the SMTP specs are tighten.

> P.S.: There is 1 'L' in my given name.

Sorry.  I'll make sure to remember there is one 'l' in your given name.

PS:   Why are you an A-HOLES!?   No wonder nothing is getting DONE!!
Anyone who tries to contributes GETS shot down with ad-nuisance rhetoric.
Maybe if you shit and get off the pot and WRITE SOME BETTER SOFTWARE with
all the EXPERTISE you speak of, then maybe the world would be better off
with PHIL-WARE!

---

From: "Hector Santos" <[email-masked]>
Date: Thu, 18 Dec 2003 20:59:08 -0500

This is getting really ridiculous here.  What/who do we have here?  Where
are the developers?   Where are the vendors?    We can't leave this to the
whims of people like you!

I made it PERFECTLY PLAIN AND CLEAR in the many messages here what steps and
add-valued functionality was added to enhanced the results.

1)  RFC 2821 compliancy test by using compliant SMTP-BASED callback on the
RETURN PATH provided by the client.

2) Add-value:  Open Relay Test

Now, the only PART that was weak about the SMTP-BASE callback was the
TIMEOUT as you saw with your system.   I need to relax it more per the
recommendation in the spec.   The CALLBACK was designed to be fast.   One or
two mishaps is should not throw the baby with the bath water.  Not when its
knocking off over 85% of the spoofing spammers!

-- Hector

---

From: Philip Miller <[email-masked]>
Date: Thu, 18 Dec 2003 21:12:06 -0500

Hector Santos wrote:
>> Looking at this log, something is unclear to me. Are you connecting to
>> the comcast.net server that's connected to you, or are you connecting
>> to a query-returned MX for zemos.net? Your manual tests in your later
>> response to Markus indicate that you're checking against zemos.net, but
>> that's not explicit here. In fact, I see no mention of zemos.net in the
>> WSCAP log other than in my address.
> 
>> What exact DNS queries are you making, what connections are you
>> opening, and what commands are you sending? I'm not about to tell all
>> of the other zemos.net MX operators to log SMTP transactions to debug
>> your broken software.
> 

I said no such thing. The log message you posted gave no indication that 
WCSAP received the response NXDOMAIN. Thus, I assumed that it made the 
connection that one would expect (to a zemos.net MX) and the verification 
failed there.

>> If you're connecting to the comcast.net server in an attempt to verify
>> the return path, that's WRONG! If it accepted mail for zemos.net, it 
>> would be an open relay.
> 
> Look,  the DOMAIN PART of your return address, ZEMOS.NET is used for the

I see that, but it was something I had to ask, since your log output didn't 
indicate it explicitly.

> Sorry.  I'll make sure to remember there is one 'l' in your given name.

No memory required. It appears in the headers of every email I send.

> all the EXPERTISE you speak of, then maybe the world would be better off

There's no question in my mind that the software you are writing is useful 
and is an improvement over many other things on the market or freely available.
Look at it this way: You're writing commercial software. We are debugging 
edge cases in your software for free. I understand that the DNS failure we 
just witnessed was an odd anomaly that your software couldn't have done 
anything to prevent. However, its log output didn't indicate that anomalous 
result, but something else.
This isn't about who's smarter. It's about reducing spam through 
technological means.

Yes, I made remarks I shouldn't have, and I regret that. We don't need 
personal remarks on this list.

Philip Miller

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 18 Dec 2003 21:38:34 -0500

Hector,

COOL IT! If you have personal remarks of this nature to make, and feel 
absolutely required to make them, do it off-list or email both co-chairs 
off-list. If you cannot maintain civilized behavior without resorting to 
flaming, than you are more than welcome to leave.

Sincerely,
Yakov Shafranovich
Co-Chair, ASRG

> ----- Original Message ----- 
....
> 
>>What exact DNS queries are you making, what connections are you opening,
> 
> and
> 

....

-------

---

From: Kee Hinckley <[email-masked]>
Date: Fri, 19 Dec 2003 00:24:18 -0500

>was a 10 second delay in the response.   I need to increase this timeout.

That will make it less likely.  Failures are always possible, and 
long delays as well.  True, spam is more likely to delay 
longer--legit senders tend to have better DNS servers, but it won't 
solve the problem.  What we've found is that every DNS-related test 
needs to have three exit paths--succeeded, failed, and didn't finish. 
And even failed can't always be trusted.  (Nor succeeded, if Verisign 
pops up its ugly head again.)

We use mail verification in certain limited circumstances with our 
software.  It can't be used as a definitive indicator, but it can add 
some weight to a decision.  One thing you will run into.  There are a 
quite a few auto-responders out there (including at least one 
challenge/response system) that send replies to anyone who sends them 
a RCPT TO--regardless of whether you send a DATA command.  So make 
sure your MAIL FROM is *not* the recipient of the message you are 
testing, but is a separate address that can handle spurious replies.

>when the SMTP specs are tighten.

That particularly tightening will never happen.  At the HELO prompt 
most mail servers have absolutely no idea what domain is going to be 
used in the MAIL FROM of the message, and of course there may be 
multiple MAIL FROM's from multiple domains in a given session.  You 
could ask, and it could happen, that the domain in the HELO actually 
resolve to the machine doing the sending (although even that can be 
problematic).  But mapping it to a relationship with the MX of the 
MAIL FROM is a major architectural change.

>Maybe if you shit and get off the pot and WRITE SOME BETTER SOFTWARE with

Feel free to try it and see if you think it's better :-).
-- 
Kee Hinckley
http://www.messagefire.com/         Next Generation Spam Defense
http://commons.somewhere.com/buzz/  Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.