Subject: Wildcards not useable

From: Douglas Otis <[email-masked]>
Date: Tue, 10 Aug 2004 15:32:01 -0700

As I understand, Sender-ID also does not provide a wildcard mechanism.
This leaves a general problem of needing a means to express various mail
polices regarding a domain and perhaps subsequent sub-domains.  This
could include whether all messages are signed digitally, all use CSV,
etc.  

The Not Authorized aspect of CSV-CSA was intended only to offer added
protection, should a system be considered vulnerable to being
compromised.  Such as a system may provide web or shell services, but is
not intended to be sending mail.  A specific removal of this host from
being authorized adds additional protections from Trojans.  The CSV-CSA
record was not intended to be published at every SOA.  A general policy
record could fulfill this role, but it should not be encumbered with
excess baggage, as to make obtaining the information problematic or
require additional lookups.

-Doug

---

From: Mark Lentczner <[email-masked]>
Date: Tue, 10 Aug 2004 22:27:51 -0700

On Aug 10, 2004, at 3:32 PM, Douglas Otis wrote:
> being authorized adds additional protections from Trojans.

Actually, the Not Authorized CSV record doesn't help against Trojans: 
Those mailers are never going to use the infected host's domain name in 
HELO/EHLO.

What would help is simply blocking outgoing port 25 access for those 
hosts.  In fact this is much more effective: The receiving MTA doesn't 
have to support CSV for it to work!  If I were a sys. admin., that's 
what I'd do.

	- Mark

Mark Lentczner
http://www.ozonehouse.com/mark/
[email-masked]