Subject: [Asrg] Opt-Out ideas/suggestions?

From: Fredrik Pettai <[email-masked]>
Date: Thu, 22 Sep 2011 10:45:14 +0200

Hi,

I'm wondering where I can find any information about discussed opt-out ideas? I only found these old ones in the archives:

http://www.ietf.org/mail-archive/web/asrg/current/msg02082.html
http://www.ietf.org/mail-archive/web/asrg/current/msg02167.html
http://www.ietf.org/mail-archive/web/asrg/current/msg02252.html
http://www.ietf.org/mail-archive/web/asrg/current/msg02280.html

Has there been any more discussions regarding opt-out (which I must have missed), or is the opt-out track abandoned?
Is there a subgroup I should join for further discussions regarding opt-out?

Regards,
/P

---

From: "John Levine" <[email-masked]>
Date: 23 Sep 2011 00:25:46 -0000

>I'm wondering where I can find any information about discussed
>opt-out ideas?

I don't recall any discussion of them in recent years.

If you mean opt-out marketing, adding people to lists and then telling
them they can ask it to stop, that's the legal standard in US law, but
nobody but spammers does that.  I've seen some hypothetical designs
that might be sort of OK if executed perfectly, but in reality anyone
who does opt-out does it sloppily and annoys vast numbers of unwilling
recipients.

If you mean opt-out as in how people get off mailing lists after
they've subscribed, although ESPs have all sorts of overcomplex
setups a la lashback, it really shouldn't be very complex unless
your processes are already badly screwed up in other ways.

R's,
John

---

From: "BOBOTEK, ALEX" <[email-masked]>
Date: Fri, 23 Sep 2011 00:34:15 +0000

A notable example of 'opt-out' that comes to mind is not in the world of email, but the 'do not call' list used for telephony.  

Email 'appending' might be considered an 'opt-out' mailing list development practice.  For example, I occasionally get UCE aimed at construction and insurance lawyers.  I have a rare surname and my brother is an insurance/construction lawyer, so I'm targeted.  I'm more inclined to hit both 'this is spam' button and the unsubscribe button in these cases.  

Hope this helps.

Regards,

Alex

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> John Levine
> Sent: Thursday, September 22, 2011 5:26 PM
> To: [email-masked]
> Subject: Re: [Asrg] Opt-Out ideas/suggestions?
> 
> _______________________________________________
> Asrg mailing list
> [email-masked]
> http://www.irtf.org/mailman/listinfo/asrg

---

From: "John Levine" <[email-masked]>
Date: 23 Sep 2011 01:39:22 -0000

>A notable example of 'opt-out' that comes to mind is not in the world
 of email, but the 'do not call' list used for telephony.

True.  The do-not-spam list is one of those  ideas that keeps
coming around.  Phones and e-mail are not really comparable here
because there is a fixed well-known set of phone numbers, while
there isn't a fixed set of e-mail addresses.  I can easily list all
the numbers I don't want people to call, but I can only describe the
set of email addresses not to spam by using pattern matching.

R's,
John

---

From: Chris Lewis <[email-masked]>
Date: Thu, 22 Sep 2011 22:19:45 -0400

> set of email addresses not to spam by using pattern matching.

And it's seldom that one would be able to do that accurately with the 
variety of email addresses one might accumulate.

I should also note that the "opt-out" standard, while legal in the US, 
isn't (or won't be) valid in other jurisdictions.

Looking at the links that Fredrik suggested, it looks to be about some 
sort of "do not email" list.

Recall that:

- Rodney Joffe implemented one (mainly to forestall/embarrass the DMA's, 
see below), in which not only individual addresses, but whole domains 
(corporates do have the right to make such decisions, remember).  In 
short order it had about 100M entries.  But no sender deigned to use it. 
  Rodney proved his point, and it was dismantled.

- the DMA invented one.  For a short period, they allowed domains to 
opt-out (in in-person discussions with them in 1998, they reluctantly 
put it on the table.  I did enter our domains on behalf of my employer), 
but rapidly realized that they were shooting themselves in the foot. 
While their opt-out seems to still exist, they do not even hint at the 
possibility of a domain-wide opt-out anymore.  I think the functionality 
was silently dropped.  I highly doubt any sender of any significance 
ever used it.

- When CANSPAM was enacted in 2003, the FTC was tasked with 
investigating the idea of enforceable opt-out lists implemented in some 
way.  In copious discussions with stake-holders (several of the people 
on ASRG were in them, including me ;-), the FTC eventually concluded 
that it could not be made to work safely.  That the service itself 
cannot be secured adequately, and even if it was, it would not be 
effective in making an appreciable dent in spam, much of which is 
illegal in many other ways already.

- There are a number of opt-out lists now.  Most out-and-out frauds, and 
none has ever been demonstrated to make any difference.

In the end, the reality is that most spammers would never use a opt-out 
list even if one could be implemented safely.  Only a few large 
organizations with reputations to lose would.  In general, it would make 
little difference to the spam flood.

Also, as John mentions, there are many things that make the idea moot. 
Including the staggering revelation that if you only do opt-in, you 
don't have to implement massive unwieldy global opt-out mechanisms that 
will probably leak, and be relatively little used.

---

From: Richard Kulawiec <[email-masked]>
Date: Fri, 23 Sep 2011 06:58:49 -0400

Opt-out is spamming.  (Or conversely, any mailing list operated
without a proper opt-in procedure is a vehicle for spam.)

---rsk

---

From: Douglas Otis <[email-masked]>
Date: Fri, 23 Sep 2011 09:27:31 -0700

> without a proper opt-in procedure is a vehicle for spam.)
Agreed.

-Doug

---

From: John Leslie <[email-masked]>
Date: Fri, 23 Sep 2011 13:45:50 -0400

>> without a proper opt-in procedure is a vehicle for spam.)

   I can't resist the opportunity to disagree with Doug...

On 23 Sep 2011 01:39:22 -0000 "John Levine" <[email-masked]> wrote:
> 
> ["BOBOTEK, ALEX" <[email-masked]> wrote:]   

   Opt-out, in fact, is entirely possible; but it needs to be a
distributed service, with database and decisions at or very-near
the mail-distribution-agent.

   (And I make no claim there is a supportable economic paradigm for
it: but after all, this is a RESEARCH group; this is a legitimate
research topic nonetheless.)

   In the SMTP world, only the MDA _can_ know what mailbox an email
will be delivered to -- thus it's plain that the MDA is the ideal
(if not only) place to implement a workable opt-out mechanism.

   Subscription to the opt-out service by the recipient has to be a
private transaction between the recipient (or his agent) and the
operator of the MDA. As such, the details of the subscriptions are
necessarily private (and any attempt to end-run that guarantees
the information to be out-of-date).

   IMHO, the subscription -- to give value to the subscriber --
must include _whether_ to return an error, as well as whether to
bit-bucket or quarantine the emails covered by opt-out.

   Likewise IMHO, the subscription must allow different classes of
opt-out conditions. Ideally, some of these might be set by "honest"
mass-mailers; others will necessarily imply filtering algorithms
by the MDA. Probably, the subscription would include whitelisting
for "known-good" senders, mainained by the subscriber (but note
that whitelists which include only "sender email address" have many
problems).

   Anyone want to take this as a research topic?

   (Yes, this _is_ remarkably close to what many ISPs already do...)

--
John Leslie <[email-masked]>

---

From: "John Levine" <[email-masked]>
Date: 23 Sep 2011 18:19:08 -0000

>   Anyone want to take this as a research topic?

Sounds to me that with extensive (and well funded) research, we might
reinvent RSS and Atom.  Spam filters are basically recipient side
opt-out, implemented at great expense, and I don't see any reason
that relabelling them as opt-out doozits rather than spam filters
would make them any more desirable.

In other media, there's enough friction and expense in the sending
process to make the senders of opt-out messages somewhat selective in
who they target.  Since sending e-mail is within rounding error of
free, there's no natural friction and the natural strategy is to send
every message to everyone until they make you stop, thereby causing
the well-known scaling problems.

I was reading somewhere about the history of 19th c. telegrapny, and
there was a story about a carrier that offered flat-rate access for
a while.  Whaddaya know, they had to switch back to charging by the
message because of all the spam.

R's,
John

---

From: Douglas Otis <[email-masked]>
Date: Fri, 23 Sep 2011 11:37:37 -0700

On 9/23/11 10:45 AM, John Leslie wrote:
> Douglas Otis<[email-masked]>  wrote:
> On 23 Sep 2011 01:39:22 -0000 "John Levine"<[email-masked]>  wrote:
>> ["BOBOTEK, ALEX"<[email-masked]>  wrote:]
John,

Keeping an opt-out list secret can't work.

A) What would be the penalty for those that did not know of an opt-out 
and yet received an opt-in?
B) What would be the penalty for those that send to the opt-out simply 
because they were listed?
C) How would case A or B be determined?
D) Who would accept penalty notifications?
E) What would be used to determine accountability?
  1- source IP address?
  2- DKIM signature (easily spoofed)?
  3- SPF (authorization not authentication)?

The only identifiable and thereby safely accountable entity would be the 
IP address owner.

With many messages originating from compromised systems, any enforcement 
would be analogous to a notification that a system or network has been 
compromised.  Which organization would manage the announcement of the 
blackhole lists?  But we are already doing just that in various fashions.

Until such time there is effective enforcement (removal of IP address 
routing for example), opt-out is still an excuse used by spammers.   Any 
legal permission in this regard represents bad law.  Fortunately, it is 
still within the prerogative of recipients what traffic they'll accept.

-Doug

>
> --
> John Leslie<[email-masked]>

---

From: John Leslie <[email-masked]>
Date: Fri, 23 Sep 2011 15:10:26 -0400

John Levine <[email-masked]> wrote:
> [John Leslie wrote:]
> Sounds to me that with extensive (and well funded) research,

   "well-funded research"? Whazzat? ;^)

> we might reinvent RSS and Atom.

   I'm not necessarily against that... They really don't work as well
as they should...

> Spam filters are basically recipient side opt-out,

   Exactly!

> implemented at great expense, and I don't see any reason that
> relabelling them as opt-out doozits rather than spam filters

   Well, of course, if some of the "great expense" could be offset...

> the well-known scaling problems.

   Who are you, and what have you done with the John Levine who so
assiduously speaks against e-postage?

> message because of all the spam.

   I'm afraid that train has left the station: too many ISPs find
flat-rate the only way to keep customers, and too many consumer PCs
are easily herded into bot-nets.

   :^(

---

From: John Leslie <[email-masked]>
Date: Fri, 23 Sep 2011 15:27:08 -0400

> Keeping an opt-out list secret can't work.

   Of course it can, if sufficiently distributed. There might be a
protocol for communicating desires to the MDA-maintainer, but such
traffic need never leak to an upstream, and the database would be
entirely proprietary.

>    and yet received an opt-in?

   Howzzat? I can't imagine any appropriate penalty beyond the opt-in.

>    because they were listed?

   I don't understand that question either...

> C) How would case A or B be determined?

   Ditto.

> D) Who would accept penalty notifications?

   I don't believe I mentioned any...

>  3- SPF (authorization not authentication)?

   The question of accountability only arises if there is a contract
between the mass-mailer and the MDA-maintainer -- in which case it
is a contract issue.

> The only identifiable and thereby safely accountable entity would be the 

   While it may well make sense to use source-IP to verify that a
particular email is covered by contract, that too feels like a contract
issue.

> blackhole lists?  But we are already doing just that in various fashions.

   Actually, no. Enforcement could be limited to the MDA in question.

   At first blush, it seems reasonable to use results to feed the
algorithms of blacklist maintainers, but that goes beyond the research
I was suggesting...

> routing for example), opt-out is still an excuse used by spammers.

   The excuse, alas, will remain until the US Congress is fixed.

   Whether the research _might_ lead to a way to feed good information
to "honest opt-out" mass-mailers is an open question. Clearly it would
need some contract between mass-mailer and MDA (which seems to exceed
any initial research project.

> Any legal permission in this regard represents bad law.

   +1

---

From: Douglas Otis <[email-masked]>
Date: Fri, 23 Sep 2011 15:41:33 -0700

> traffic need never leak to an upstream, and the database would be
Consider what happened with Blue Security.  Although lists were private, 
when applied, content became obvious.  Not offering DSN will require 
some method to resolve delivery issues.
>     Howzzat? I can't imagine any appropriate penalty beyond the opt-in.
What you seem to be describing are mail filtering rules.  However, 
random junk easily side steps such rules.  This brings us back to opt-in 
with perhaps review of junk folders for strays.  Again where we are today.
>     I don't understand that question either...
This was based on the assumption no opt-out, or spam trap for that 
matter, can be kept secret.
>> C) How would case A or B be determined?
This will not reduce the amount of abuse, nor alter any of the burdens 
on the receiver.

Cryptographic authentication of the sending MTA, not the message, would 
offer a more effective opt-out scheme when acceptance is predicated on 
authentication of the entity responsible for authenticating actual 
senders and asserting intended recipients.  This can be done by 
confirming either the MSA or the MHA acting on behalf of the MSA.  A 
simple SMTP token exchanged to validate possession of the private half 
of a DANE certificate would be a good starting point.  Perhaps just the 
use of TLS with these certificates.
>     I don't believe I mentioned any...
Because you think op-out lists can be kept secret.  Never returning 
delivery status but not delivering may have a few down sides.
> between the mass-mailer and the MDA-maintainer -- in which case it
There is no real benefit when the same amount of "accepted" mail is 
still exchanged.
> particular email is covered by contract, that too feels like a contract
Neither regex rules nor IP addresses alone will block abuse.  When it 
doesn't, what identifier is to be held accountable?
>     Actually, no. Enforcement could be limited to the MDA in question.
You are expecting to accept all unwanted email?  We tried that, but this 
becomes a type of email black-hole sucking in ever increasing amounts.  
You'll need more servers and storage for this scheme that will grow and 
grow.
> algorithms of blacklist maintainers, but that goes beyond the research
And another place where acceptance information is leaked.

-Doug

---

From: "John Levine" <[email-masked]>
Date: 23 Sep 2011 23:04:28 -0000

>traffic need never leak to an upstream, and the database would be

Could you describe concisely how this thing differs from a spam filter?
The more you describe it, the more identical it sounds.

Spammers send lots of mail, the filter throws away everything the
recipients don't want, letting a little bit through.  That's
Spamassassin.

What am I missing?

R's,
John

---

From: "John Levine" <[email-masked]>
Date: 23 Sep 2011 23:07:52 -0000

>> Since sending e-mail is within rounding error of free, there's no
>> natural friction and the natural strategy is to send every message
>> to everyone until they make you stop, thereby causing the
>> well-known scaling problems.

>assiduously speaks against e-postage?

Humph. I assumed "... therefore the whole idea is unworkable" was obvious.

>are easily herded into bot-nets.

That's flat rate internet access, which has all sorts of advantages.
For details, see nearly anything Andy Odlyzko has written.

We put friction on e-mailers by applying penalties to those who send
mail that recipients don't want.  I agree that the current system is
not very good, but we don't seem to have much success coming up with
something better.

R's,
John

---

From: John Leslie <[email-masked]>
Date: Fri, 23 Sep 2011 19:30:20 -0400

Douglas Otis <[email-masked]> wrote:
>> Of course it can, if sufficiently distributed...
> 
> Consider what happened with Blue Security.

   I assume you refer to the DDoS on Blue Security's Blue Frog list.
Being a centrally-maintained list, DDoS is possible. For distributed
opt-out service at MDAs, individual lists they might query _are_
subject to DDoS, but DDoS on the MDAs themselves isn't practical.

> Although lists were private, when applied, content became obvious.

   Yes, content of such centrally-maintained lists will become obvious.

> Not offering DSN will require some method to resolve delivery issues.

   Strictly, yes; but that method can filter through individual MDA
customers -- who for the most part will be quite happy to deep-six
anything spam-like (as happens today).

   MDA-maintainers have no reason to accept such complaints from the
mass-mailers absent a contract in place.

> What you seem to be describing are mail filtering rules.

   I certainly wouldn't limit it to that.

> However, random junk easily side steps such rules. This brings us back
> to opt-in with perhaps review of junk folders for strays.

   That depends on how you define "opt-in"...

   Technically, it's possible to gather opt-in confirmations and
whitelist the particular List-ID and MTA (though not trivial).

   If the service in question _participates_ in the opt-in, it could
provide additional "secrets" to check on incoming email.

   Personally, I doubt it's worth the trouble for a researcher to try
to duplicate all the details of how ISPs do filtering today -- instead
one needs to invent rules of what "opt-out" _means_. For a start, an
opt-out request from a customer probably _doesn't_ mean you hunt down
an unsubscribe process for any senders except those with contractual
arrangements (possibly through a clearing service).

   Another point: "botnet" email likely deserves to be quietly discarded.

> Again where we are today.

   A lot of it _is_ pretty similar -- but there's the opportunity to
better match the actual desires of different customers.

> matter, can be kept secret.

   Hopefully we can agree _some_ opt-out listings can be kept secret.

> This will not reduce the amount of abuse, nor alter any of the burdens 

   I didn't claim it would.

> senders and asserting intended recipients.

   I quite agree!

> This can be done by confirming either the MSA or the MHA acting on
> behalf of the MSA. A simple SMTP token exchanged to validate
> possession of the private half of a DANE certificate would be a good
> starting point.  Perhaps just the use of TLS with these certificates.

   I'd recommend researchers try that...

> delivery status but not delivering may have a few down sides.

   Yes, but that's an issue between customer and MDA-maintainers.

> There is no real benefit when the same amount of "accepted" mail is 

   I'm not sure -- that's a question for research.

> doesn't, what identifier is to be held accountable?

   IMHO, absent a contract, "accountability" is a wasted effort.

> You'll need more servers and storage for this scheme that will grow and 

   My experience doesn't support quite that much pessimism.

   However, there are a number of tricks, the simplest being simply
simulating the high packet-loss of a vastly overloaded MDA. I doubt,
however, that that issue will arise during the research phase.

> And another place where acceptance information is leaked.

   Agreed!

---

From: Douglas Otis <[email-masked]>
Date: Mon, 26 Sep 2011 11:13:10 -0700

> subject to DDoS, but DDoS on the MDAs themselves isn't practical.
What has been described seems like adding inbound filters at the receiver.

The only benefit that could be gained would be to share the list either 
directly or via delivery status with bulk senders.   Blue Security has 
shown sharing will not work.  Unfortunately, not returning negative 
delivery status continues the erosion of email's integrity.  Accepting 
all mail irrespective of delivery leads to its own type of DoS.

Are you suggesting that the sharing be done via delivery status?
> mass-mailers absent a contract in place.
If you are suggesting use of receiver side filters,  how does that 
differ from what we have today?
>     I certainly wouldn't limit it to that.
It would be dangerous to use this as a basis for reputation when senders 
do not receive notification, where recipients may use filters to replace 
unsubscribe after subscribing.  That is the case A/B question not 
understood.
>     Another point: "botnet" email likely deserves to be quietly discarded.
Receivers conditionally sharing email lists of their customers with 
various bulk senders would not seem to be a good practice.
> better match the actual desires of different customers.
I think most would desire their email addresses kept private as much as 
possible.  A response that says in effect, "localpart@domain doesn't 
want your email", also says this is a valid email-address in active use.
>     Hopefully we can agree _some_ opt-out listings can be kept secret.
Secrecy offers no benefit beyond that of a spam filter.
>     Yes, but that's an issue between customer and MDA-maintainers.
What specifically do you see this offering over a spam filter.  Is this 
advocating a standard method for providers to implement mail filters?
>     IMHO, absent a contract, "accountability" is a wasted effort.
How would you ensure an opt-out is effective and that there is some benefit in adopting the practice?

> however, that that issue will arise during the research phase.
The technique of dropping packets also leads to more aggressive retries 
as bulk senders attempt to empty their queues.   At some point a 
negative response is needed, but this will also leak information.  
Otherwise, this will require an increased number of servers.

The recipient desires can be more effectively enforced when the outbound 
MTA can be authenticated, and not just authorized.  That way any abuse 
can be stopped at the source where there would be real benefit and fewer 
servers required.

-Doug

---

From: John Leslie <[email-masked]>
Date: Mon, 26 Sep 2011 15:25:44 -0400

Doug's questions are better directed to a prospective researcher: I
am not proposing to do any of this myself.

Douglas Otis <[email-masked]> wrote:
>... 
>...
>...
>...
>...
>...
>...

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 27 Sep 2011 10:01:08 +0200

> without a proper opt-in procedure is a vehicle for spam.)

As factual as that assertion is, it must be said that opt-in lacks a
required feature:  any A who just happened to invent B, want to notify
the news to X, Y, and Z.  Even if A were able to sharply select
prospects, they'd need an initial set to select them from.

Consider this (is it spam?)

   Dear Xyz,
            you receive this because you subscribed to the
   Acme Customers Group.  Now, we just happened to invent B!

IOW, opt-out implies the existence of some "fuzzy opt-in" set, which
can be built in widely different ways, e.g. interest lists/groups,
public directories, harvested addresses, million-address CDs, swiped
personal address books, et cetera.

---

From: John Leslie <[email-masked]>
Date: Tue, 27 Sep 2011 09:26:24 -0400

Alessandro Vesely <[email-masked]> wrote:
> As factual as that assertion is,

   Whether it is "factual" depends on how you define "opt-in".

   There are those (like at least one US Senator I know) who define
"opt-out" as "I can subscribe you to any list I invent; and it's your
problem to figure out how to unsubscribe _and_ what risks that may
involve."

   I think we all agree _that_ is spamming. (Well, perhaps not all US
senators: but I don't think there are any on this list.)

   I consider that definition entirely too extreme. I think of
opt-out more along the lines of a "do-not-call" list, where you get
one listing defining that you don't want to be auto-subscribed to
_any_ mailing-list.

   (Of course, that opens a grey area; since typically folks opt-in
by clicking a web link -- and that results in one email: and there's
really nothing to prevent spammers from anonymously generating those
clicks for a large number of target addresses...)

> it must be said that opt-in lacks a required feature: any A who just
> happened to invent B, want to notify the news to X, Y, and Z. Even if
> A were able to sharply select prospects, they'd need an initial set
> to select them from.

   Actually, RSS _should_ be good for that...

>    Acme Customers Group.  Now, we just happened to invent B!

   Certainly, for probably the majority of recipients it _is_
unsolicited commercial email. But, of course, if they think kindly
of A -- and this is the only email notification concerning B, they
will probably forgive A.

   Exactly!

   Clearly, some interest groups are focused enough for some
"near-topic" announcements to be appropriate; while most lists of
harvested addresses are not.

   But it's hard to convince amateur spammers that their pet project
isn't actually of interest to more than 50% of the general population.
(I tried once and failed, and had to fire that customer.)

   It may be that most readers of this list prefer the extreme
definition that started this email. If so, I think any thread under
an "opt-out" title needs to die. If not, we might try discussing
"opt-out" to mean "each user can register, with some assurance of
privacy, the desire to not receive certain kinds of unsolicited email".

   (Or perhaps it would be better to invent another name for that...)

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 27 Sep 2011 16:34:38 +0200

> of A -- and this is the only email notification concerning B, they

Thus, it is UCE but, if you define "spam" what is reported as such, it
is not.

> harvested addresses are not.

More than "near-topic", it is usually tagged "same-vendor".   A happy
Acme customer can put up with some unsolicited announces, as long as
they don't come too often.

>    (Or perhaps it would be better to invent another name for that...)

Obviously, people can only solicit something if they know it exists.

How about the complementary approach, "each user can register, with an
even weaker assurance of privacy, the desire to receive certain kinds
of unsolicited email"?  By complementarity, those who don't register
at all, can be assumed to be not interested in any of the available
topics.

---

From: Alessandro Vesely <[email-masked]>
Date: Wed, 28 Sep 2011 11:24:10 +0200

On 24/Sep/11 01:30, John Leslie wrote:
>> However, random junk easily side steps [filtering] rules. This brings
>> us back to opt-in with perhaps review of junk folders for strays.
> 

To gather confirmation stealthily is not only difficult, but also
questionable for what concerns the subscriber's consent.

> provide additional "secrets" to check on incoming email.

The participation of the subscriber's MTA can significantly harden
opt-in practices.  However, it requires a consent-exchange Internet
protocol for email users.  That can allow MLMs to send list messages
using existing authentication methods, including SMTP AUTH.  The
resulting "triple opt-in" can also feature

* an automatically updated list of subscriptions and redirections,
* actual possibility to erase or rectify each of them,
* easy verification of legitimate behavior,
* catching some illegitimate disclosures of addresses, and
* better anti-spam filtering by whitelisting legitimate messages.

> one needs to invent rules of what "opt-out" _means_.

Since opt-out implies an initial set of addresses anyway, and such
addresses _must_ result from opt-in, it seems that while we want to
harden opt-in on the one hand, we want to weaken it on the other.

> For a start, an opt-out request from a customer probably _doesn't_
> mean you hunt down an unsubscribe process for any senders except
> those with contractual arrangements (possibly through a clearing
> service).

Using SMTP AUTH, an MTA can reply "550 user opt-out" right after the
relevant RCPT TO.  Consider that a participating MTA can subscribe
[email-masked]: it is not required to pass the same email
address when the same user subscribes to different lists, even if they
are managed by the same MLM.