Subject: Re: Argh. the spam.. make it stop...

From: "Stephen Sprunk" <[email-masked]>
Date: Thu, 1 Apr 1999 10:51:57 -0600

There was a proposal to fix that a while back, but it was killed for lack of
interest.  The idea was to create a pseudo-tld for "mobile" services like
smtp; 'smtp.local.' would resolve to whatever the local smtp server's
address was, etc.

Perhaps this should be revived?

Stephen

     |          |         Stephen Sprunk, K5SSS, CCIE #3723
    :|:        :|:        NSA, Network Consulting Engineer
   :|||:      :|||:       14875 Landmark Blvd #400; Dallas, TX
.:|||||||:..:|||||||:.    Pager: 800-365-4578 / 800-901-6078
C I S C O S Y S T E M S   Email: [email-masked]

-----Original Message-----
From: Keith Moore <[email-masked]>
To: Vernon Schryver <[email-masked]>
Cc: [email-masked] <[email-masked]>
Date: Wednesday, March 31, 1999 22:25
Subject: Re: Argh. the spam.. make it stop...

>>  It's trivial to fix an open relay with current software
>
>bullfeathers.
>
>Apparently your idea of "fixing" a mail relay is to configure
>it so that it will only accept local mail.  But mobile users
>need to be able to submit mail to a fixed address, regardless
>of which POP they happen to dial in to on a given day.
>
>Right now, the only alternatives we have appear to be:
>
>- run completely open and allow spammers to exploit us
>- close down relaying and break our users' ability to send mail
>- ask the user to authenticate to a POP or IMAP server,
>  which (given the current state of authentication in mail
>  clients) is tantamount to expecting the user to send his/her
>  password over the wire.  (okay, a lot of them will do that
>  anyway, but we're trying to discourage that)
>
>Once we have SMTP AUTH widely deployed in clients, folks
>who run servers will have the option to
>
>- allow relaying for authenticated, authorized users, and
>  accept only local mail for everyone else
>
>which seems like a fairly optimal solution.  With any luck,
>the clients that are updated to use SMTP AUTH will also
>implement better (non cleartext) authentication in POP and IMAP.
>
>It is quite possible that the push to "fix" mail relays is doing
>nothing to reduce the amount of spam.  It is, however, causing a
>lot of pain for folks who need to support mobile users, and it is
>causing people to implement various half-baked measures that further
>fragment the net.
>
>As for ISPs filtering SYNs on port 25, any ISP that does that
>will certainly lose *my* business.
>
>Keith

---

From: [email-masked]
Date: Thu, 01 Apr 1999 12:27:24 -0500

> Perhaps this should be revived?

I suspect that RFC2165 addresses the problem in a more general way.

However, this doesn't fix the problem.  Let's say I go on a road trip,
take a laptop along, and I connect to Joes' ISP.  smtp.local. resolves
to mail.joes-isp.com, I try to relay my mail through there.

And it gets rejected because neither my From: nor To: are affiliated
with joes-isp.com, I'm merely getting connectivity from them.

You have to use *another* mechanism so that either joes-isp.com
knows that you're a "real" mobile user as opposed to a spammer,
or one to allow your home SMTP server to know that you're you
and not a dialup spammer.  Thus the growth of SMTP AUTH and
SMTP-after-POP and the like.

-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: [email-masked]
Date: Thu, 01 Apr 1999 12:27:24 -0500

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 13:25:19 -0500

> Perhaps this should be revived?

no.

we should do our best to eradicate such practices.  the last thing we 
need is to have a bunch of folks allocating their own TLDs.

also, we should not assume that people set their default DNS server, 
or their DNS search path, to that of the PoP that they're dialing into.
nor should we assume that they are supposed to use that PoP's SMTP server.

Keith

---

From: Keith Moore <[email-masked]>
Date: Thu, 01 Apr 1999 13:25:19 -0500

no.

Keith

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 01 Apr 1999 11:05:16 -0800

>nor should we assume that they are supposed to use that PoP's SMTP server.

Nor that most operating systems (where DNS resolution is done) would 
perform this kind of resolution correctly. Nor that, if they do it 
incorrectly, the user would be able to figure out what went wrong. Nor that 
there will never be a TLD of ".mail" or whatever we chose today.

Have we re-debated this topic to death yet?

--Paul Hoffman, Director
--Internet Mail Consortium

---

From: Paul Hoffman / IMC <[email-masked]>
Date: Thu, 01 Apr 1999 11:05:16 -0800

--Paul Hoffman, Director