Subject: RE: DOC-BUG: permitted use of PRA/submitter address

From: "Harry Katz" <[email-masked]>
Date: Mon, 30 Aug 2004 11:43:20 -0700

On Sunday, August 29, 2004 4:34 PM, [email-masked] wrote:

> It's hard from the current drafts to figure out when exactly 
> it is appropriate to send mail to the PRA of a received mail 
> message.  I'm guessing this is because the authors are 
> relying on previous RFCs for this.  However, given that a lot 
> of people are already confused by the distinction between 
> envelope and From: address, there is a danger that the 
> introduction of a third address would lead to an even larger 
> number of broken vacation-type programs.
> 
> I'd like to suggest that the Sender ID (or maybe the PRA or 
> SUBMITTER) document have somewhere a non-normative paragraph 
> that clues people in to how they can learn about appropriate 
> uses of the PRA.  As an example, here are a bunch of 
> questions whose answers are not immediately obvious from 
> reading Sender ID and associated drafts:
> 
> * Is it ever actually required that the PRA be a valid mailbox?  Is it
>   legal to construct some mailbox whose domain has an SPF2 record but
>   not an MX or A record?  I presume the answer is no, but that the
>   logic involves some other RFC I'm just not looking at.  How would
>   you go about convincing an administrator this is wrong.
> 
> * I am on vacation, and receive mail which lists my own address in the
>   To: or CC: fields, and does not have any indications such as
>   "Precedence: list/bulk/junk" that it is from a mailing list.  I wish
>   for my filter to notify the sender that I will not be responding for
>   a week.  Should I send the notification to the MAIL-FROM address, as
>   I currently do, or to the PRA?
> 
> * I receive mail with an attachment that contains a virus.  I wish to
>   configure my MUA or spam filter automatically to notify the sender
>   that his/her machine has a virus and the attachment has been
>   deleted.  Should I send mail to the PRA?  Can/should that mail come
>   from the empty envelope sender, or should/must it come from my real
>   email address?
> 
> * I have been erroneously subscribed to a mailing list.  Should I
>   complain directly to the PRA?  Should I attempt to form a new
>   address by appending "-owner" or "-request" to the local part of the
>   PRA?  Or should I complain to an address based on the envelope
>   sender, as I currently would.
> 
> * I receive offensive and/or threatening mail from someone, and wish
>   to complain to their administrator.  Should I complain to
>   postmaster/abuse at the domain name in the PRA, as opposed to the
>   domain in the From or envelope sender address?
> 
> * In order to reduce spam, I currently perform an SMTP callback on the
>   envelope sender of mail, ensuring that any mail I accept could have
>   been bounced.  (This is highly effective against spam from
>   virus-infected machines, because many machines infected by viruses
>   can make outgoing TCP connections but not accept incoming ones, and
>   thus are forced to use other people's often invalid envelope
>   senders.)  In case of forgery, people can block these callbacks by
>   using SPFv1 records.  Once we have Sender ID, should I instead
>   perform SMTP callbacks to validate the SUBMITTER or PRA address
>   rather than MAIL-FROM, so as to avoid wasting bandwidth of sites
>   whose addresses are being forged?

The PRA doesn't replace or over-ride any of the semantics around mail
replies or notifications.  It is intended only as a mechanism to
identify the entity most recently responsible for injecting the message
into the mail system.  If you normally send a bounce to the 2821 MAIL
FROM address, you would continue to do so.  If you normally send a reply
to the 2822 From or Reply-To address, you would continue to do so.   

Section 4.2 of the submitter-03 draft has the following paragraph which
addresses, at least in part, this very issue.

   Note that the presence of the SUBMITTER parameter on the MAIL command
   MUST NOT change the effective reverse-path of a message.  Any
   delivery status notifications must be sent to the reverse-path, if
   one exists, as per section 3.7 of [SMTP] regardless of the presence
   of a SUBMITTER parameter.  If the reverse-path is null, delivery
   status notifications MUST NOT be sent to the SUBMITTER address.

---

From: <[email-masked]>
Date: Mon, 30 Aug 2004 16:14:43 -0400

On Mon, 30 Aug 2004 11:43:20 -0700, Harry Katz
<[email-masked]> wrote:
> > message...
> > ...

One problem may be that when I read the words "delivery status
notification", to me that has a very specific meaning (in the sense of
RFC1891).  Is that paragraph also supposed to cover auto-generated
messages of the form "I'm on vacation and will read your message next
week," or "Your attachment contained a virus and has been removed"?

It also still doesn't address the question of whether the PRA must be
a valid email address.  I'm assuming that if the email address does
exist, then the domain in the PRA is considered to offer mail service
and must have RFC2142 mailbox names like abuse and postmaster.  I
don't see anything in the drafts that prevents someone from using the
PRA simply as a non-functioning syntactic placeholder or level of
indirection for authentication.  (And of course, if I were a spammer,
I certainly wouldn't be interested in setting up a working PRA.)

I guess I'm particularly curious what people think about virus
notifications.  (I care a lot about this question because at times I
get thousands of messages a day telling me my mail has been infected
with a virus, when of course I didn't send the virus, but rather the
virus forged my email address.)  It seems to me that if you get mail
with a virus, the person whose machine is infected is most likely the
PRA, not the MAIL-FROM address.  Therefore, I would be tempted to
configure my mail filter to send automatic notifications to the PRA,
instead of the MAIL-FROM address.  So the questions are:

1. Is there anything in the drafts to prevent me from sending such
notifications to the PRA?

2. Is the PRA required to exist/accept such notifications.  Should the
PRA be a human rather than an autoresponder?

3. Is the PRA required to accept mail from the empty envelope sender,
even through any RFC1891-type DSNs/bounce messages should still be
sent to the MAIL-FROM address?

David

---

From: <[email-masked]>
Date: Mon, 30 Aug 2004 16:14:43 -0400

David