Subject: [marf] list of current approval criteria (was Re: Poll: Importing draft-jdfalk-marf-reporting-discovery)

From: "J.D. Falk" <[email-masked]>
Date: Sun, 4 Jul 2010 15:31:09 -0600

On Jun 24, 2010, at 4:20 PM, [email-masked] wrote:

> If you are going to put together a list of potential discovery options, you might want to start by collecting a list of current approval criteria.  That would give you an idea of how acceptable the various discovery options would be.

A fine idea...but unfortunately, most feedback generators don't publish their criteria.  I collected what I could find into the following document:

http://www.ietf.org/id/draft-jdfalk-marf-acceptance-criteria-00.txt

(In many cases I have personal knowledge which goes far beyond the published information, but I didn't want to include anything non-public here without asking permission first.)

--
J.D. Falk <[email-masked]>
Return Path Inc

---

From: Alessandro Vesely <[email-masked]>
Date: Mon, 05 Jul 2010 12:52:55 +0200

On 04/Jul/10 23:31, J.D. Falk wrote:
> unfortunately, most feedback generators don't publish their criteria.  I collected what I could find into the following document:
>

A nice starting point, although it is difficult to deduce the nature 
of FBLs from their approval criteria.

In section 4 (Comcast) the line "IPs with a Sender Score of 30 to 60 
cannot appear on any DNSBLs" is worded badly.  They probably mean the 
same of the corresponding point in section 5 (Cox), which is worded 
much better.  However, the 3rd point in the latter policy explicitly 
states that FBL access will be denied for small senders who have no SS 
score.  Statistical relevance has been discussed before, but this kind 
of requirement may also reveal some difficulties within the approval 
process.

Unfortunately, SS doesn't publish much about the actual meaning of "a 
sufficient volume of email".  Besides size, it is striking that the 
reviewed operators are all US-based, with the exception of OpenSRS 
which is located in Toronto, and possibly Yahoo!.  I'd guess that high 
volume Japanese local senders may get a missing SS score as well.  Is 
it so?

One final nit, section 2 misses AOL's 2nd requirement (The domain 
WHOIS for each IP's RDNS contains the FBL email domain).

---

From: "J.D. Falk" <[email-masked]>
Date: Mon, 5 Jul 2010 06:40:02 -0600

On Jul 5, 2010, at 4:52 AM, Alessandro Vesely wrote:

> A nice starting point, although it is difficult to deduce the nature of FBLs from their approval criteria.

Yeah, it's not intended as a descriptive or BCP document.

> In section 4 (Comcast) the line "IPs with a Sender Score of 30 to 60 cannot appear on any DNSBLs" is worded badly.  They probably mean the same of the corresponding point in section 5 (Cox), which is worded much better.  However, the 3rd point in the latter policy explicitly states that FBL access will be denied for small senders who have no SS score.  Statistical relevance has been discussed before, but this kind of requirement may also reveal some difficulties within the approval process.
> 
> Unfortunately, SS doesn't publish much about the actual meaning of "a sufficient volume of email".  Besides size, it is striking that the reviewed operators are all US-based, with the exception of OpenSRS which is located in Toronto, and possibly Yahoo!.  I'd guess that high volume Japanese local senders may get a missing SS score as well.  Is it so?

Like any reputation system, Sender Score is based on the data available.  That includes data contributed by both Comcast and Cox (among others), so it's relevant for their systems -- if they've seen sufficient traffic from an IP, there'll be a score calculated.  But this document only lists what the published criteria currently are; it's not an attempt to say what the criteria could be, or should be.

The one nearly-universal thing is that they try to correlate the request with ownership of the domain and IPs, and they do this out of band by sending a confirmation email containing a (presumably) unique HTTP URL.  I believe that an advertisement in DNS could provide an equal (or better) level of authentication, and speed up the subscription process because a prospective subscriber could be approved or denied immediately rather than waiting for their abuse@/postmaster@ staff to respond.

After that, I don't see much opportunity for standardization -- though I'd certainly support a BCP calling for Feedback Generators to make more of their criteria public.

---

From: Alessandro Vesely <[email-masked]>
Date: Tue, 06 Jul 2010 13:01:42 +0200

On 05/Jul/10 14:40, J.D. Falk wrote:
>>  it is difficult to deduce the nature of FBLs from their approval criteria.
>

I see.  However, say a new organization asks advice about launching 
their new email infrastructure:  Would you include subscribing to 
selected FBLs among the tasks they should do?

> I believe that an advertisement in DNS could provide an equal (or better) level of authentication

The DNS, much like subscription requests, contains unverified 
addresses, while a private list would only contain domains whose email 
contact has been tested.

> After that, I don't see much opportunity for standardization

In case we'll conclude that an FBL is a useful tool to have, why 
shouldn't everybody have a chance to implement it?  Such approach 
might scale up to each mail domain maintaining a list of all other 
mail domains subscribed to its FBL.

> though I'd certainly support a BCP calling for Feedback Generators to make more of their criteria public.

+1, and also their consenting subscribers...

Are there staffers of AOL, BlueTie, Comcast, Cox, Earthlink, 
Microsoft, Outblaze, OpenSRS, Rackspace, Road Runner, USA.net, and 
Yahoo! on this mailing list?

---

From: "J.D. Falk" <[email-masked]>
Date: Tue, 6 Jul 2010 16:37:54 -0600

On Jul 6, 2010, at 5:01 AM, Alessandro Vesely wrote:

> I see.  However, say a new organization asks advice about launching their new email infrastructure:  Would you include subscribing to selected FBLs among the tasks they should do?

That'd go in a BCP document, wouldn't it?

> The DNS, much like subscription requests, contains unverified addresses, while a private list would only contain domains whose email contact has been tested.
> In case we'll conclude that an FBL is a useful tool to have, why shouldn't everybody have a chance to implement it?  Such approach might scale up to each mail domain maintaining a list of all other mail domains subscribed to its FBL.

I'm confused.  In this thread, I've been talking about subscription acceptance policies.  It sounds like you're talking about something entirely different, but I'm not sure what it is.

> Are there staffers of AOL, BlueTie, Comcast, Cox, Earthlink, Microsoft, Outblaze, OpenSRS, Rackspace, Road Runner, USA.net, and Yahoo! on this mailing list?

They've all been encouraged to participate.  Some are here.  Some rely on their 3rd party Feedback Generator (my employer) to tell them about any new developments.