Subject: testing of MARID proposals

From: Andrew Newton <[email-masked]>
Date: Fri, 6 Aug 2004 12:36:28 -0400

At IETF 60, I was approached by a very large ISP willing to do some 
testing of the MARID proposals (Sender ID & CSV).  They have asked for 
advice on testing, so I thought I'd ask the experts (you!).

Quite simply, they are seeking advice on the variables to measure and 
guidelines for deployment and evaluation of such tests.

Their hope is that they will be able to come back to the MARID working 
group with a report on what they have found.

So, your advice is welcome.  But I do ask one favor: please do not 
formulate any such advice in the form of Sender ID vs CSV.

-andy

---

From: Hadmut Danisch <[email-masked]>
Date: Fri, 6 Aug 2004 10:28:55 -0700

> advice on testing, so I thought I'd ask the experts (you!).

What kind of ISP? Hoster of large number of domains? Or many users
within a single domain?

An important test would be the definition of MARID records. Where do
these records come from? Give every customer a default record which
should work for most of them and allow them to modify? Or let users
start from scratch? Is the average user able to understand what's
going on? What kind of user interface? How much load does this mean
for the hotline people required to help users? How long does the
average user need to have a correct record and how many tries? How
many 'good' mails are lost until so? How frequently does the average
user change the record after he had a working one for the first time?
Is the average user able to understand this at least in principle?

What impact does it have on mail delivery? Do users prefer to cover
their own machines with the record or do they deliver through the
ISP's machines? 

What's the average length of the MARID record? How many replies do not
fit into a UDP DNS result?

Are MARID records an invitation for attacks? Are machines mentioned in
MARID records under higher attack than others?

How does the load of the DNS servers increase? Do they need faster
processors, more memory, more bandwidth?

And again: Fox6 News reported that policy departments are launching
special task forces against phishing. It would be good to get into
contact with them to find out whether they do know anything about 
fraudulent attacks what we don't know yet but need to take into
consideration.

Hadmut

---

From: wayne <[email-masked]>
Date: Fri, 06 Aug 2004 12:44:47 -0500

In <[email-masked]> Andrew Newton <[email-masked]> writes:

> testing of the MARID proposals (Sender ID & CSV).

Great!

> guidelines for deployment and evaluation of such tests.

For Sender ID, the stuff that Mark Lentczner reported was quite
useful.  Or, at least, I found the detailed reports to be useful.  My
analysis of the data and why various parts are important can be found
at:
http://www.imc.org/ietf-mxcomp/mail-archive/msg02776.html

Mark wrote a perl script to generate this data, but it makes the
assumption that there are no post-edge MTA relays, which is not true
for my mail boxes nor for the Spamassassin corpus.  I'm fiddling with
Mark's script to see if I can get good data from either source.

> formulate any such advice in the form of Sender ID vs CSV.

I suspect that only SPF-classic has enough published domains to do any
real testing on.

Currently, Sender ID makes the assumption that v=spf1 records are
valid to be used for Sender ID checks.  While I personally agree that
this asumption is almost always true, it was decided at the IETF-60
session that this was not a safe assumption.  One useful thing to test
for is whether this assumption is really true or not.

Personally, I think it would be very useful to also test the
SPF-classic results for both the MAIL FROM and the HELO.  

As far as CSV testing, my understanding is that few domains have
published the SRV records needed to test it.  I suspect that people
more knowledgable about CSV deployment may be needed to develop useful
tests.

A couple of days ago, I went through my inbox to see how many valid
emails I have received that had HELO domains that did not resolve to
the IP address of the client MTA.  I never finished going through the
list or giving a real report, but I thought the following list was
interesting none the less.

[192.74.137.143] helo=TheWorld.com
   Maybe if this "Barry Shein" guy had more experience running a
   public ISP, he wouldn't have his HELO domain wrong.

[205.143.207.126] helo=hera.prod.geico.com
   Yeah, no one would mind losing email from GEICO.

[66.35.250.206] helo=sc8-sf-mx2.sourceforge.net
   These guys have no idea about creating and using software.

[128.242.147.150] (helo=nu.jumpserver.net)
   this is the registrar/DNS hoster that I've used since the mid 90s.
   
[206.222.212.237] helo=midwestcs.com
   The guy is an idiot.

[216.145.52.229] helo=yahoo-inc.com
   Small, two-bit company with no experience with email and they
   haven't been around very long anyway.

[206.45.235.30] helo=mail.pan-am.ca
   This guy obviously has no clue about designated sender systems and
   what needs to be done to make them work reliably.

(I thought I had sendmail.com for a sec, but it is just their forward
and reverse not matching.) 

[216.239.56.194] helo=cwar25.prod.google.com
   Yeah, another two-bit company that has nothing to do with email.

[208.198.98.24] helo=CORPMAIL1.roving.com
   What can I say?  Email is not their thing.

</VERY heavy sarcasm>

Mind you, these were emails to my person-to-person inbox, not stuff
from mailing lists, so the volume is fairly low and fairly restricted.
I think the above list represents about half of the MTAs that used
invalid HELO domains.  Overall, I found that around 20% of all
valid, person-to-person email I received had an invalid HELO domain.

-wayne

---

From: "Douglas Otis" <[email-masked]>
Date: Fri, 6 Aug 2004 11:24:51 -0700 (PDT)

>> testing of the MARID proposals (Sender ID & CSV).
...

> </VERY>

It should be expect that those that do publish the CSV-CSA record will
ensure the host name of their outbound MTAs are accurately reflected in
the EHLO domain reported.  Until then, all bets are off.

-Doug

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Fri, 6 Aug 2004 22:10:40 +0200

On Fri, Aug 06, 2004 at 12:36:28PM -0400,
 Andrew Newton <[email-masked]> wrote 
 a message of 15 lines which said:

> testing of the MARID proposals (Sender ID & CSV).  They have asked
> for advice on testing, so I thought I'd ask the experts (you!).

I agree with wayne here. There is not enough Sender-ID or CSV
deployment to do a real testing. Your ISP would have to write its own
software to test what? Non-existing Sender-ID records...
 
Also, spammers only react when the threat (to them) is
sufficient. Spammers/phisers did not start yet to adapat to LMAP
protocols because they are not deployed enough.

A technical experiment could be interesting but the real experiment
will be the social one and it can only be done in real, once MARID is
common.

> So, your advice is welcome. 

Install SPF in test mode for several months on a real server and
report the results (how many legitimate mails would have been bounced,
how many spams got through, increase of the DNS traffic, etc). At
least, it would yield interesting results.

---

From: "John Glube" <[email-masked]>
Date: Fri, 6 Aug 2004 17:07:05 -0400

Andy,

The last item on the agenda for the MARID meeting was to
formulate milestones for CSV. Were these settled?

If so, may we have these milestones sent to the list?

Thanks,

John
 
John Glube
Toronto, Canada
 
The FTC Calls For Sender Authentication
http://www.learnsteps4profit.com/dne.html

---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.734 / Virus Database: 488 - Release Date: 04/08/2004

---

From: Andrew Newton <[email-masked]>
Date: Sat, 7 Aug 2004 09:07:58 -0400

> If so, may we have these milestones sent to the list?

I believe we settled on Oct. 11 for wglc of the CSV docs?

-andy