Subject: [ietf-smtp] Fwd: New Version Notification for draft-shafranovich-privacy-mailbox-00.txt

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 13 Jun 2018 16:33:24 -0400

I originally posted this to the DISPATCH list but Murray Kucherawy
recommended that these two lists may be a more appropriate forum to
solicit feedback. Thank you in advance.

Draft:
https://datatracker.ietf.org/doc/html/draft-shafranovich-privacy-mailbox

Abstract:
   Multiple Internet standards describe common mailbox names (mailbox @
   domain) to be used by organizations for operational and business
   functions.  This document defines a new mailbox called "privacy" that
   SHOULD be used for contacting domain name owners about privacy
   issues.

---

From: John C Klensin <[email-masked]>
Date: Wed, 13 Jun 2018 17:53:07 -0400

Yakov,

A quick comment about the general idea of these reserved mailbox
names.  They were a good idea when we started using them (and,
of course, "Postmaster" goes back to before our current model of
email).  However, in today's environment, one of the nicest
gifts we can give to the spammers and other spreaders of chaos
and DoS attacks on email servers is to hand them a list of
local-parts of addresses that every mail server that supports
delivery to local mailboxes is required or strongly encouraged
to support.  Postmaster accounts now get enough unwanted mail
that has nothing to do with the Postmaster function that a large
fraction of those who try to read and understand that traffic on
a daily or better schedule probably have too much time on their
hands.

So, please analyze, what happens if a "privacy" address (along
with "Postmaster", "abuse", etc., addresses) is put up and
immediately overwhelmed by spam.  Is it worthwhile anyway?  Do
you have a good model for mitigating the abusive traffic to an
address that ought to be open to traffic from "strange" sources
to make sure that complaints are either received or the sender
understands that they were not.  And then, if you sti8ll think
going ahead with this is a good idea, please include that
analysis in your I-D.

Just my opinion and speaking for no one else.
     best,
       john

--On Wednesday, June 13, 2018 16:33 -0400 Yakov Shafranovich
<[email-masked]> wrote:

> I originally posted this to the DISPATCH list but Murray
> Kucherawy recommended that these two lists may be a more
> appropriate forum to solicit feedback. Thank you in advance.
> 
> Draft:
>    Multiple Internet standards describe common mailbox names
> (mailbox @    domain) to be used by organizations for
> operational and business    functions.  This document defines
> a new mailbox called "privacy" that    SHOULD be used for
> contacting domain name owners about privacy    issues.

---

From: Yakov Shafranovich <[email-masked]>
Date: Wed, 13 Jun 2018 18:14:38 -0400

John,

Thank you for the feedback, I will certainly try to address it.

As a side note - the spamming issue is an issue for all reserved names
- perhaps it is time to deprecate majority of RFC 2142, except for
whatever is actually being used?

Thanks

---

From: [email-masked]
Date: Wed, 13 Jun 2018 18:31:48 -0400

> whatever is actually being used?

And which role addresses would those be? How would you identify them?

(Note that for the "business-related" ones - info, marketing, sales, support -
there's often more mail coming *out* with those role addresses than any
expectation that sending mail *to* [email-masked] will do anything
useful...)

Bonus points for determining what to do with role addresses for domains that
exist only to prevent typosquatters from monetizing near misses, or owned by
the typosquatters.  Compare and contrast coke.com and c0ke.com (oh versus
zero).

---

From: John C Klensin <[email-masked]>
Date: Wed, 13 Jun 2018 23:57:36 -0400

> As a side note - the spamming issue is an issue for all
> reserved names - perhaps it is time to deprecate majority of
> RFC 2142, except for whatever is actually being used?

Noting Valdis's comment as well, my personal guess it that
attempting to do that would cause sufficient noise that actually
deciding on the list of names to deprecate and then doing it
would cost far more in resources than it would be likely to
gain.  But, from my point of view, if you want to try it, write
the I-D and go for it.

best,
    john

---

From: Alessandro Vesely <[email-masked]>
Date: Thu, 14 Jun 2018 12:45:39 +0200

> whatever is actually being used?

I can't resist to note that the abuse@ local part has a special role w.r.t.
spamming, since they are exactly the team who takes care of that issue.  What
do they do about abuses, ban IP addresses, adjust content filters, take legal
action?  Whatever it is, they can do it immediately.  A real producer to
consumer delivery!

Best
Ale
--

---

From: "John R. Levine" <[email-masked]>
Date: 14 Jun 2018 11:55:06 +0100

>> whatever is actually being used?

I wouldn't worry about it.  Some of the names are fairly widely used, 
postmaster and abuse, the rest seem harmless enough.

I am [email-masked], which got some interestingly misdirected mail 15 
years ago but nothing unusual now.

Regards,
John Levine, [email-masked], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly