Subject: Re: [Asrg] DKIM role?

From: Franck Martin <[email-masked]>
Date: Thu, 20 Nov 2008 10:16:55 +1200 (ANAT)

what about sending the NDR to [email-masked] ? 

and does the DKIM is not related to the domain of the first MTA sending, so you can send to postmaster@MTADomain ? 

For the report to be useful, you need to send it to someone that care, or should be caring.... 

----- Original Message ----- 
From: "Rich Kulawiec" <[email-masked]> 
To: "Anti-Spam Research Group - IRTF" <[email-masked]> 
Sent: Thursday, 20 November, 2008 9:56:37 AM (GMT+1200) Auto-Detected 
Subject: Re: [Asrg] DKIM role? 

On Wed, Nov 19, 2008 at 06:55:59PM +0000, Ian Eiloart wrote: 
>> The latter. There's no point in sending a NDR in response to malware 
>> or spam (and many reasons not to). Just reject it outright during 
>> the SMTP conversation, and let the sending system deal with that. 
> 
> Agreed, but the OP's point was that such a reply (which may be unrelated 
> to the message source or content) can be sent if you're sure the message 
> was sent by the owner of the envelope sender - ie with a DKIM pass. 

But (a) that doesn't mean it was really sent by the user and 
(b) it still doesn't serve any useful purpose. 

Let's put aside (b) for the moment and focus on (a). One of the things 
I've noticed about quite a few mail servers over the past several years 
is that while an increasing number of them are moving to require user 
authentication (even when sending from networks local and known to 
the mail server) that (1) many don't and (2) some which do don't force 
the envelope-sender to match the authenticating user. In the case of (1), 
many mail servers still seem to allow submission from local/known networks 
with no authentication...which in turn means that any system on those 
networks can send mail as any user known to the mail server, which in 
turn means that a batch of spam purportedly from [email-masked] may 
not have anything to do with mary or mary's system. (Note that malware 
resident on any end-user system local to mail.example.com is likely to 
find a sizable list of users to choose from simply by rummaging through 
the contents of disk.) In case case of (2), a system authenticating 
as [email-masked] may be able to send traffic as [email-masked], 
depending on its capabilities and configuration. (I'm aware of a number 
of variations on this, including one site that deliberately left this 
open in order to allow mary to send as [email-masked], 
[email-masked], etc., and is counting on their post-processing 
of logs to detect any exploitation of it.) 

_______________________________________________
Asrg mailing list
[email-masked]
https://www.irtf.org/mailman/listinfo/asrg

---

From: Rich Kulawiec <[email-masked]>
Date: Wed, 19 Nov 2008 17:35:28 -0500

> what about sending the NDR to [email-masked] ? 

That's much worse, for a lot of reasons, including everything I already
listed plus myriad scalability and privacy issues.  Best practice
is encapsulated in the phrase "always reject, never bounce" -- which
*can* be difficult in some edge cases, but we're far from the point,
operationally, where everyone has dealt with the rest and we can turn
our attention to those.

---Rsk

---

From: Michael Thomas <[email-masked]>
Date: Wed, 19 Nov 2008 17:06:12 -0800

Franck Martin wrote:
> and does the DKIM is not related to the domain of the first MTA sending, 
> so you can send to postmaster@MTADomain ?
> 

DKIM does not provide a protocol means of providing feedback to
the signing domain. It doesn't prevent it either. We're free to
experiment around, use wetware-wetware connections, create
programatic but unstandardized feedback amongst willing participants,
etc, etc. If any of this ultimately proves to have standardization
implications we could pursue it then, but we're not there yet.

		Mike

> ------------------------------------------------------------------------
>