Subject: RE: How is SPF different from RMX?

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Tue, 3 Aug 2004 17:30:13 -0700

> Wrong and misleading as well. I have given you a large number 
> of specific faults: (I'll summarize)
> 
> 	1) Abuser can forge addresses at domain

This is a risk, not a specific threat. it appears that you are referring
to the fact that forwarded mail can only authenticate to the last sender,
not the original sender.

This is an understood issue for which other controls are relevant.

> 	2) Abuser can use stolen credential

This claim makes no sense whatsoever in the context of Sender-ID since
there is no private key coresponding to the DNS record, there is no
knowledge that can be stolen.

The vulnerabilities to DNS and BGP spoofing are understood and are
out of scope.

> 	3) DNS cache problems (more records per domain, same cache size)

Irrelevant.

> 	4) DNS load (more records per domain)

Irrelevant. 

> 	5) Ongoing Maintenance issues

Vague.

> 	6) Migration issues

Vague and irrelevant. 

> 	7) IP Renumbering issues

Utterly irrelevant.

> 	8) Lost non-spam emails

Not an issue, all Sender-ID does is to provide a means of whitelising
good email, it is not a mechanism for rejecting bad emails, that 

> 	9) Lack of universal compliance.*

Uninterested.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 10 Aug 2004 19:13:32 -0400 (EDT)

> This is an understood issue for which other controls are relevant.

It is a way to circumvent SPF. It is not a "risk", it is a vulnerability.  

> The vulnerabilities to DNS and BGP spoofing are understood and are

This has nothing to do with DNS. "Stolen Credential" means username and 
password.  Virus infected machines have the credentials of the machines' 
owner. The virus can use these.

I didn't list DNS spoofing or BGP spoofing. BGP spoofing is beyond the
capabilities of most spammers.  Its happened, but its rare. DNS spoofing,
however, is within their capabilities, but I didn't list that.

> > 	3) DNS cache problems (more records per domain, same cache size)

Impact on other protocols is relevent.

> > 	4) DNS load (more records per domain)

Impact on other protocols is relevent.

> > 	5) Ongoing Maintenance issues

You obviously haven't read the emails. Maintainence issues were clearly
explained.

> Vague and irrelevant. 

You obviously haven't read the emails. Migration issues were clearly
explained.

> Utterly irrelevant.

Impact on business activities is relevant.

> good email, it is not a mechanism for rejecting bad emails, that 

Impact on business activities is relevant.  Lost email is an issue for
those who will lose emails and business as a result.

But I agree that SPF is just a whitelist scheme, and we already have a 
perfectly good whitelist method in DNS already.  We've had DNS blacklists 
for many years, and it is trivial to make a DNS whitelist.

> > 	9) Lack of universal compliance.*

I see that. That doesn't mean that it isn't an issue. "Lack of interest" 
seems to be a common problem with anti-spam proposals. I think that's why 
they fail so often.

---

From: Dean Anderson <[email-masked]>
Date: Tue, 10 Aug 2004 19:45:02 -0400 (EDT)

> > to the fact that forwarded mail can only authenticate to the last sender,

And no, I'm not referring to the fact that forwarded mail can only
authenticate to the last sender.  I'm refering to the fact that anyone at
AOL.com can pretend to be anyone else at AOL.com.

---

From: "Alan DeKok" <[email-masked]>
Date: Wed, 11 Aug 2004 10:44:36 -0400

> AOL.com can pretend to be anyone else at AOL.com.

  That's AOL's problem.

  If you can prove you got "bad" email from AOL, it's their
responsibility to track down the cause & fix it.

  How is the scenario you quote any different from a user at AOL
sending bad mail, "from" himself?

  Alan DeKok.

---

From: Dean Anderson <[email-masked]>
Date: Wed, 11 Aug 2004 18:44:38 -0400 (EDT)

> > AOL.com can pretend to be anyone else at AOL.com.

As it has been all this while. AOL still has spammers signing up.

> responsibility to track down the cause & fix it.

We already do this now.  AOL generally boots abusers. This doesn't happen
instantaneously, however.

> sending bad mail, "from" himself?

It's not any different. That is my point: This will have no effect on
spam:  Spam comes from disposable accounts now. It comes from Virus
infected machines now.  Abusers simply adapt, and keep on what they were
doing before.  

Abusers cost to adapt: practically $0.00. 

Our cost: Very expensive.

		--Dean

---

From: Dean Anderson <[email-masked]>
Date: Wed, 11 Aug 2004 20:22:20 -0400 (EDT)

I should add that I don't mean to unduly pick on AOL. Their spam problem
is not any worse or any better than anyone elses. Other ISPs have the same
problem.  At most, I would say only that residential ISPs as a category
seem to have a worse problem than do ISPs catering purely to business. And
that residential customers and by extension residential ISPs have a worse
virus-infection problem than do business customers.  I think this is not a
coincidence.  Anyway, AOL is used just the concrete example.  My only
gripe about AOL (as some may know) is that AOL is not against spam, but
only against spam that doesn't pay it advertising fees to communicate to
its users.

		--Dean