Subject: RE: mail-abuse.org tests, and weird addresses...
From: "Woodhouse, Gregory J." <[email-masked]>
To: "[email-masked]'" <[email-masked]>, John C Klensin <[email-masked]>
Cc: [email-masked]
Date: Thu, 20 Jul 2000 11:58:58 -0500
List-Id: <ietf-smtp.imc.org>

I believe it's in last call now.

===
Gregory Woodhouse <[email-masked]>
Financial Product Line
+1 415 744 6362
"Computer science is no more about computers than astronomy is
about telescopes." -- E.W. Dijkstra

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]
Sent: Wednesday, July 19, 2000 2:34 PM
To: John C Klensin
Cc: [email-masked]; [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 

On Wed, 19 Jul 2000 00:07:40 EDT, John C Klensin said:
> If my memory is correct, 501 (syntax error) is intended, as was
> the exclusion of 553 from the MAIL FROM responses.  I agree that
> the 1123 text is a little muddy (and it is probably at least
> partially my fault).  Please take a look at
> draft-ietf-drums-smtpupd-12.txt and see if you think it is clear
> and good enough; if not, comments should probably go to the DRUMS
> list (copied on this response).

Yes, 501 *is* the correct error, and your example of an embedded blank
getting a 553 was better.

smtpupd section 4.3.2 specifically allows any/all of 501, 550, and 553
on the MAIL FROM: which gives future releases of Sendmail sufficient room
to work.  That text looks good and reasonable.

Is there a target date for smtpupd to move out of Draft status and into
RFC, where it will be more cite-able without being a moving target?

-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

Date: Wed, 19 Jul 2000 18:36:59 -0700
From: Doug Royer <[email-masked]>
Organization: Software.com
To: Keith Moore <[email-masked]>
CC: [email-masked], Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses...
Sender: [email-masked]

Keith Moore wrote:
> 
> > > > MAIL FROM:<[email-masked]@other.domain>
> > >
> > > Sendmail currently issues a '250 OK'.
> >
> > I think it is a valid address.
> 
> it is invalid syntax in both RFC821 or RFC822.
> 
> Keith

Yep -Oh well - the older I get the more I think that gray
hair is brain cells leaking :-)

-Doug

From: "Soegi Hartono" <[email-masked]>
To: "Gregory J. Woodhouse" <[email-masked]>, "Keith Moore" <[email-masked]>
Cc: "Doug Royer" <[email-masked]>, <[email-masked]>, "Kyle Jones" <[email-masked]>, <[email-masked]>, <[email-masked]>
Subject: Re: mail-abuse.org tests, and weird addresses... 
Date: Wed, 19 Jul 2000 14:12:05 -0700
Sender: [email-masked]

I've tried to send e-mail like this syntax user%host1@host2, it successfully
sent but it's not getting to the final destination, anyone know?

-----Original Message-----
From: Gregory J. Woodhouse <[email-masked]>
To: Keith Moore <[email-masked]>
Cc: Doug Royer <[email-masked]>; [email-masked]
<[email-masked]>; Kyle Jones <[email-masked]>;
[email-masked] <[email-masked]>; [email-masked]
<[email-masked]>
Date: Wednesday, July 19, 2000 1:40 PM
Subject: Re: mail-abuse.org tests, and weird addresses...

It's been a long time, but I once had to use the so-called "%-hack" in my
e-mail address, but I believe you are correct that user@host1@host2 is
incorrect syntax. I'm curious, does sendmail treat this as equivalent to
user%host1@host2?

On Wed, 19 Jul 2000, Keith Moore wrote:

> > > > MAIL FROM:<[email-masked]@other.domain>
> > >
> > > Sendmail currently issues a '250 OK'.
> >
> > I think it is a valid address.
>
> it is invalid syntax in both RFC821 or RFC822.
>
> Keith
>

---
Gregory Woodhouse
[email-masked]    /    http://www.wnetc.com/home.html
"An atheist staring from his attic window is often nearer to God than the
believer caught up in his own false image of God."
--Martin Buber

From: [email-masked]
To: John C Klensin <[email-masked]>
Cc: [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Date: Wed, 19 Jul 2000 17:33:57 -0400
Sender: [email-masked]

--==_Exmh_-1278297722P
Content-Type: text/plain; charset=us-ascii

On Wed, 19 Jul 2000 00:07:40 EDT, John C Klensin said:
> If my memory is correct, 501 (syntax error) is intended, as was
> the exclusion of 553 from the MAIL FROM responses.  I agree that
> the 1123 text is a little muddy (and it is probably at least
> partially my fault).  Please take a look at
> draft-ietf-drums-smtpupd-12.txt and see if you think it is clear
> and good enough; if not, comments should probably go to the DRUMS
> list (copied on this response).

Yes, 501 *is* the correct error, and your example of an embedded blank
getting a 553 was better.

smtpupd section 4.3.2 specifically allows any/all of 501, 550, and 553
on the MAIL FROM: which gives future releases of Sendmail sufficient room
to work.  That text looks good and reasonable.

Is there a target date for smtpupd to move out of Draft status and into
RFC, where it will be more cite-able without being a moving target?

-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

--==_Exmh_-1278297722P
Content-Type: application/pgp-signature

--==_Exmh_-1278297722P--

Date: Wed, 19 Jul 2000 13:37:57 -0700 (PDT)
From: Gregory Neil Shapiro <[email-masked]>
To: "Gregory J. Woodhouse" <[email-masked]>
Cc: Keith Moore <[email-masked]>, Doug Royer <[email-masked]>, [email-masked], Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Sender: [email-masked]

gjw> It's been a long time, but I once had to use the so-called "%-hack" in my
gjw> e-mail address, but I believe you are correct that user@host1@host2 is
gjw> incorrect syntax. I'm curious, does sendmail treat this as equivalent to
gjw> user%host1@host2?

Yes.

Date: Wed, 19 Jul 2000 13:32:25 -0700 (PDT)
From: "Gregory J. Woodhouse" <[email-masked]>
To: Keith Moore <[email-masked]>
cc: Doug Royer <[email-masked]>, [email-masked], Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Sender: [email-masked]

It's been a long time, but I once had to use the so-called "%-hack" in my
e-mail address, but I believe you are correct that user@host1@host2 is
incorrect syntax. I'm curious, does sendmail treat this as equivalent to
user%host1@host2?

On Wed, 19 Jul 2000, Keith Moore wrote:

> > > > MAIL FROM:<[email-masked]@other.domain>
> > > 
> > > Sendmail currently issues a '250 OK'.
> > 
> > I think it is a valid address.
> 
> it is invalid syntax in both RFC821 or RFC822.
> 
> Keith
> 

---
Gregory Woodhouse
[email-masked]    /    http://www.wnetc.com/home.html
"An atheist staring from his attic window is often nearer to God than the
believer caught up in his own false image of God."
--Martin Buber

From: Keith Moore <[email-masked]>
To: Doug Royer <[email-masked]>
cc: [email-masked], Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Date: Wed, 19 Jul 2000 15:22:24 -0400
Sender: [email-masked]

> > > MAIL FROM:<[email-masked]@other.domain>
> > 
> > Sendmail currently issues a '250 OK'.
> 
> I think it is a valid address.

it is invalid syntax in both RFC821 or RFC822.

Keith

Date: Wed, 19 Jul 2000 10:07:54 -0700
From: Doug Royer <[email-masked]>
Organization: Software.com
To: [email-masked]
CC: Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses...
Sender: [email-masked]

[email-masked] wrote:
> 
> (Am cc'ing the IETF-SMTP list, hopefully it's alive and somebody there
> will have guidance on this... For the IETF-SMTP list, the discussion is
> what to properly do if handed this during an SMTP transaction:
> 
> MAIL FROM:<[email-masked]@other.domain>
> 
> Sendmail currently issues a '250 OK'.

I think it is a valid address. It was manually routed from one
domain to another. I used that feature a few years ago to
stop spam as a result of people scanning net-news postings.
(I posted with x@y@z). Any email that came to that address
at domain 'y' would get extra filters before relaying to domain 'z'.

It is another way of doing mail relaying.

I did an exhaustive search a few years ago. The ability to
route with multiple '@' was in an RFC, so it is valid.
(If it has not been superseded).

Set mail relay to off, if you can. (I don't know the exact keyword).
It should stop working.

-Doug

Date: Wed, 19 Jul 2000 00:07:40 -0400
From: John C Klensin <[email-masked]>
Subject: Re: mail-abuse.org tests, and weird addresses...
To: [email-masked]
Cc: Kyle Jones <[email-masked]>, [email-masked], [email-masked], [email-masked]
Sender: [email-masked]

--On Tuesday, July 18, 2000 2:32 PM -0400 [email-masked]
wrote:

> (Am cc'ing the IETF-SMTP list, hopefully it's alive and
> somebody there will have guidance on this... For the IETF-SMTP
> list, the discussion is what to properly do if handed this
> during an SMTP transaction:
> 
> MAIL FROM:<[email-masked]@other.domain>
> 
> Sendmail currently issues a '250 OK'.
>...   [more of original message  below]...

Hi.

If my memory is correct, 501 (syntax error) is intended, as was
the exclusion of 553 from the MAIL FROM responses.  I agree that
the 1123 text is a little muddy (and it is probably at least
partially my fault).  Please take a look at
draft-ietf-drums-smtpupd-12.txt and see if you think it is clear
and good enough; if not, comments should probably go to the DRUMS
list (copied on this response).

I would think that 553 would be used for a situation in which,
e.g., the left-hand-side (local-part) of an address was valid
syntax in 821 (etc) terms, but invalid for processing/ delivery
on the target host while 501 would be used for things that were
lexically unacceptable given the 821 grammar.  If that were the
theory, then a receiving SMTP wouldn't be able to comment on the
sender's local part (in MAIL FROM) as long as it obeyed the 821
syntax.  But, again, a receiving host could evaluate a local-part
syntax against its own rules.

For example, assume my host receives 

  RCPT TO:<bogus\ [email-masked]>

Almost no one has mailbox names that look like that, so bouncing
it with a 553 would be reasonable.  Bouncing it with 501 would be
less so, since the syntax, is I believe,  821-valid.  On the
other hand, the example given below is invalid everywhere in 821
systems.

      john

> On Tue, 18 Jul 2000 10:46:13 PDT, Kyle Jones
> <[email-masked]>  said:
>> The attitude I took when I ran a relaying server was that stuff
>> like a@b@c was better off bounced immediately. 
> 
> I can deal with that attitude.
> 
> However, RFC821 also lists the following codes on page 56:
> 
>          550 Requested action not taken: mailbox unavailable
>             [E.g., mailbox not found, no access]
>          551 User not local; please try <forward-path>
>          552 Requested mail action aborted: exceeded storage
>          allocation 553 Requested action not taken: mailbox
>          name not allowed [E.g., mailbox syntax incorrect]
>          554 Transaction failed
> 
> But then continues to say:
> 
>             MAIL
>                S: 250
>                F: 552, 451, 452
>                E: 500, 501, 421
>             RCPT
>                S: 250, 251
>                F: 550, 551, 552, 553, 450, 451, 452
>                E: 500, 501, 503, 421
> 
> (I.e. you can toss a 553 on the RCPT TO, but not on a MAIL
> FROM).
> 
> RFC1123 then muddies things up more:
> 
>       5.2.10  SMTP Replies:  RFC-821 Section 4.2
> 
>          A receiver-SMTP SHOULD send only the reply codes
>          listed in section 4.2.2 of RFC-821 or in this
>          document.  A receiver-SMTP SHOULD use the text shown
>          in examples in RFC-821 whenever appropriate.
> 
>          A sender-SMTP MUST determine its actions only by the
>          reply code, not by the text (except for 251 and 551
>          replies); any text, including no text at all, must be
>          acceptable.  The space (blank) following the reply
>          code is considered part of the text.  Whenever
>          possible, a sender-SMTP SHOULD test only the first
>          digit of the reply code, as specified in Appendix E of
>          RFC-821.
> 
>          DISCUSSION:
>               Interoperability problems have arisen with SMTP
>               systems using reply codes that are not listed
>               explicitly in RFC- 821 Section 4.3 but are legal
>               according to the theory of reply codes explained
>               in Appendix E.
> 
> 
> So, is it legal/permissible/suggested to 553 on a MAIL FROM
> that can be determined to be syntactically invalid?
> -- 
>				 Valdis Kletnieks
>				 Operating Systems Analyst
>				 Virginia Tech
> 
> 
> 

Date: Tue, 18 Jul 2000 16:34:46 -0400
From: Tony Hansen <[email-masked]>
Organization: AT&T Laboratories
To: [email-masked]
CC: Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses...
Sender: [email-masked]

FWIW, we respond with a 501 code.

	Tony Hansen
	[email-masked]

[email-masked] wrote:
> 
> (Am cc'ing the IETF-SMTP list, hopefully it's alive and somebody there
> will have guidance on this... For the IETF-SMTP list, the discussion is
> what to properly do if handed this during an SMTP transaction:
> 
> MAIL FROM:<[email-masked]@other.domain>
> 
> Sendmail currently issues a '250 OK'.
> 
> On Tue, 18 Jul 2000 10:46:13 PDT, Kyle Jones <[email-masked]>  said:
> > The attitude I took when I ran a relaying server was that stuff
> > like a@b@c was better off bounced immediately.
> 
> I can deal with that attitude.
> 
> However, RFC821 also lists the following codes on page 56:
> 
>          550 Requested action not taken: mailbox unavailable
>             [E.g., mailbox not found, no access]
>          551 User not local; please try <forward-path>
>          552 Requested mail action aborted: exceeded storage allocation
>          553 Requested action not taken: mailbox name not allowed
>             [E.g., mailbox syntax incorrect]
>          554 Transaction failed
> 
> But then continues to say:
> 
>             MAIL
>                S: 250
>                F: 552, 451, 452
>                E: 500, 501, 421
>             RCPT
>                S: 250, 251
>                F: 550, 551, 552, 553, 450, 451, 452
>                E: 500, 501, 503, 421
> 
> (I.e. you can toss a 553 on the RCPT TO, but not on a MAIL FROM).
> 
> RFC1123 then muddies things up more:
> 
>       5.2.10  SMTP Replies:  RFC-821 Section 4.2
> 
>          A receiver-SMTP SHOULD send only the reply codes listed in
>          section 4.2.2 of RFC-821 or in this document.  A receiver-SMTP
>          SHOULD use the text shown in examples in RFC-821 whenever
>          appropriate.
> 
>          A sender-SMTP MUST determine its actions only by the reply
>          code, not by the text (except for 251 and 551 replies); any
>          text, including no text at all, must be acceptable.  The space
>          (blank) following the reply code is considered part of the
>          text.  Whenever possible, a sender-SMTP SHOULD test only the
>          first digit of the reply code, as specified in Appendix E of
>          RFC-821.
> 
>          DISCUSSION:
>               Interoperability problems have arisen with SMTP systems
>               using reply codes that are not listed explicitly in RFC-
>               821 Section 4.3 but are legal according to the theory of
>               reply codes explained in Appendix E.
> 
> So, is it legal/permissible/suggested to 553 on a MAIL FROM that can be
> determined to be syntactically invalid?
> --
>                                 Valdis Kletnieks
>                                 Operating Systems Analyst
>                                 Virginia Tech
> 
>   ------------------------------------------------------------------------
>    Part 1.2Type: application/pgp-signature

Date: Tue, 18 Jul 2000 12:29:05 -0700 (PDT)
From: "Gregory J. Woodhouse" <[email-masked]>
To: [email-masked]
cc: Kyle Jones <[email-masked]>, [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Sender: [email-masked]

In this case, I think the correct response would be 501, since it is a
syntax error in the argument to MAIL. 

On Tue, 18 Jul 2000 [email-masked] wrote:

> (Am cc'ing the IETF-SMTP list, hopefully it's alive and somebody there
> will have guidance on this... For the IETF-SMTP list, the discussion is
> what to properly do if handed this during an SMTP transaction:
> 
> MAIL FROM:<[email-masked]@other.domain>
> 
> Sendmail currently issues a '250 OK'.
> 
> On Tue, 18 Jul 2000 10:46:13 PDT, Kyle Jones <[email-masked]>  said:
> > The attitude I took when I ran a relaying server was that stuff
> > like a@b@c was better off bounced immediately. 
> 
> I can deal with that attitude.
> 
> However, RFC821 also lists the following codes on page 56:
> 
>          550 Requested action not taken: mailbox unavailable
>             [E.g., mailbox not found, no access]
>          551 User not local; please try <forward-path>
>          552 Requested mail action aborted: exceeded storage allocation
>          553 Requested action not taken: mailbox name not allowed
>             [E.g., mailbox syntax incorrect]
>          554 Transaction failed
> 
> But then continues to say:
> 
>             MAIL
>                S: 250
>                F: 552, 451, 452
>                E: 500, 501, 421
>             RCPT
>                S: 250, 251
>                F: 550, 551, 552, 553, 450, 451, 452
>                E: 500, 501, 503, 421
> 
> (I.e. you can toss a 553 on the RCPT TO, but not on a MAIL FROM).
> 
> RFC1123 then muddies things up more:
> 
>       5.2.10  SMTP Replies:  RFC-821 Section 4.2
> 
>          A receiver-SMTP SHOULD send only the reply codes listed in
>          section 4.2.2 of RFC-821 or in this document.  A receiver-SMTP
>          SHOULD use the text shown in examples in RFC-821 whenever
>          appropriate.
> 
>          A sender-SMTP MUST determine its actions only by the reply
>          code, not by the text (except for 251 and 551 replies); any
>          text, including no text at all, must be acceptable.  The space
>          (blank) following the reply code is considered part of the
>          text.  Whenever possible, a sender-SMTP SHOULD test only the
>          first digit of the reply code, as specified in Appendix E of
>          RFC-821.
> 
>          DISCUSSION:
>               Interoperability problems have arisen with SMTP systems
>               using reply codes that are not listed explicitly in RFC-
>               821 Section 4.3 but are legal according to the theory of
>               reply codes explained in Appendix E.
> 
> 
> So, is it legal/permissible/suggested to 553 on a MAIL FROM that can be
> determined to be syntactically invalid?
> -- 
> 				Valdis Kletnieks
> 				Operating Systems Analyst
> 				Virginia Tech
> 
> 
> 
> 

---
Gregory Woodhouse
[email-masked]    /    http://www.wnetc.com/home.html
"An atheist staring from his attic window is often nearer to God than the
believer caught up in his own false image of God."
--Martin Buber

From: [email-masked]
To: Kyle Jones <[email-masked]>
Cc: [email-masked], [email-masked]
Subject: Re: mail-abuse.org tests, and weird addresses... 
Date: Tue, 18 Jul 2000 14:32:29 -0400
Sender: [email-masked]

--==_Exmh_-1656617848P
Content-Type: text/plain; charset=us-ascii

(Am cc'ing the IETF-SMTP list, hopefully it's alive and somebody there
will have guidance on this... For the IETF-SMTP list, the discussion is
what to properly do if handed this during an SMTP transaction:

MAIL FROM:<[email-masked]@other.domain>

Sendmail currently issues a '250 OK'.

On Tue, 18 Jul 2000 10:46:13 PDT, Kyle Jones <[email-masked]>  said:
> The attitude I took when I ran a relaying server was that stuff
> like a@b@c was better off bounced immediately. 

I can deal with that attitude.

However, RFC821 also lists the following codes on page 56:

         550 Requested action not taken: mailbox unavailable
            [E.g., mailbox not found, no access]
         551 User not local; please try <forward-path>
         552 Requested mail action aborted: exceeded storage allocation
         553 Requested action not taken: mailbox name not allowed
            [E.g., mailbox syntax incorrect]
         554 Transaction failed

But then continues to say:

            MAIL
               S: 250
               F: 552, 451, 452
               E: 500, 501, 421
            RCPT
               S: 250, 251
               F: 550, 551, 552, 553, 450, 451, 452
               E: 500, 501, 503, 421

(I.e. you can toss a 553 on the RCPT TO, but not on a MAIL FROM).

RFC1123 then muddies things up more:

      5.2.10  SMTP Replies:  RFC-821 Section 4.2

         A receiver-SMTP SHOULD send only the reply codes listed in
         section 4.2.2 of RFC-821 or in this document.  A receiver-SMTP
         SHOULD use the text shown in examples in RFC-821 whenever
         appropriate.

         A sender-SMTP MUST determine its actions only by the reply
         code, not by the text (except for 251 and 551 replies); any
         text, including no text at all, must be acceptable.  The space
         (blank) following the reply code is considered part of the
         text.  Whenever possible, a sender-SMTP SHOULD test only the
         first digit of the reply code, as specified in Appendix E of
         RFC-821.

         DISCUSSION:
              Interoperability problems have arisen with SMTP systems
              using reply codes that are not listed explicitly in RFC-
              821 Section 4.3 but are legal according to the theory of
              reply codes explained in Appendix E.

So, is it legal/permissible/suggested to 553 on a MAIL FROM that can be
determined to be syntactically invalid?
-- 
				Valdis Kletnieks
				Operating Systems Analyst
				Virginia Tech

--==_Exmh_-1656617848P
Content-Type: application/pgp-signature

--==_Exmh_-1656617848P--