Subject: RE: The real reason MARID won't work, RE: testing of MARID proposals

From: "Ryan Malayter" <[email-masked]>
Date: Fri, 6 Aug 2004 17:07:58 -0500

[Gordon Fecyk]
>But then we have the whole excessive DNS traffic problem again.

I haven't seen anyone present convincing evidence of "excessive DNS
traffic" when MX mechanisms are checked. Won't DNS caching will
completely eliminate any potential problem?

Where, exactly, are you seeing this excessive traffic in your systems?
What are the acutal numbers? Is it really a problem in practice, or is
it just a theoretical objection? In my (admittedly limited) tests with
SPFv1 almost all the MX and host records were already in my DNS cache.

Regards,
	Ryan

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Fri, 6 Aug 2004 15:47:59 -0700 (PDT)

> completely eliminate any potential problem?

In fact I have heard (admittedly, not seen) evidence to the contrary,
namely that even the large ISPs receive the vast majority of their e-mail
from only a few domains.  It follows that the DNS impact would quite
possibly not be as severe as we all assume.

Published empirical evidence would be great and would definitely cut down
on the room for rhetoric.

---

From: "Alan DeKok" <[email-masked]>
Date: Fri, 06 Aug 2004 23:38:25 -0400

"Murray S. Kucherawy" <[email-masked]> wrote:
> from only a few domains.

  The following stats are for how real email is distributed across
source IP's.  It's not what you're looking for, but it's indicative:

    http://www.striker.ottawa.on.ca/~aland/spam/sent.png

    http://www.striker.ottawa.on.ca/~aland/spam/sent-logscale.png

  That's more interesting.  log-log across 4 orders of magnitude.

    http://www.striker.ottawa.on.ca/~aland/spam/cumulative.png

  Any successful system getting deployed to the *right* 70k IP's will
touch 90% of the non-spam mail.

>  It follows that the DNS impact would quite possibly not be as
> severe as we all assume.

  The data I posted above is for *all* recipient domains in the data
set.  My bet is that for most recipient domains, incoming messages are
distributed exponentially across sending IP's.

  While the second doesn't follow from the first, it is often true.
Also, DNS caching wil probably mean that non-cached lookups will most
likely depend on the number of unique source IP's, and not on the
message volume.

   Alan DeKok.