Re: [apps-discuss] I-D Action: draft-ietf-appsawg-greylisting-01.txt

["Murray S. Kucherawy" <[e-mail]>]

Hi Paul,

> -----Original Message-----
> From: Paul E. Jones [mailto:[e-mail]]
> Sent: Friday, January 20, 2012 10:55 AM
> To: Murray S. Kucherawy
> Cc: [e-mail]
> Subject: RE: [apps-discuss] I-D Action: draft-ietf-appsawg-greylisting-01.txt
> 
> Mark,

Who?  ;-)

> I think it's useful to document greylisting for information purposes,
> but do we want to make it a BCP?  The reason I ask is that longer-term,
> I would think we'd want to recommend policy-oriented solutions (e.g., SPF or DKIM).
> If policies were strictly enforced and properly implemented, machines
> controlled by bots would not get past the policy enforcement.
> 
> I also question whether greylisting would be effective long-term.  I
> actually have seen some machines re-send email.  You are right that
> many just "fire and forget", but that would change if required.  So,
> elevating greylisting to BCP might just force a change in spammer
> tactics, thus rendering greylisting completely ineffective.
> 
> The reason I am supportive of documenting as informational is that
> servers should consider such implementations and that it has utility
> today.  But, calling it a "best" practice seems to be a bit much.  It's
> a practice driven out of necessity, mainly because we do not have all
> of the kinks worked out of policy-based solutions.

The original (and current) plan is to include some consensus recommended practices in terms of greylisting.  If the Working Group decides it wants to stop short of making any recommendations, then changing to Informational is entirely appropriate.  I don't have a particular preference.

The -01 version of this draft fills out the definitions of each kind of greylisting we know of and presents some background (thanks to John Levine for the text there), but I didn't fill out the recommendations section because we haven't talked about what we would like to say in there yet.

There is a small team of people within MAAWG that want to make some recommendations about greylisting, so the output of that work might be useful here.  They meet in about a month, so I'll report back after that, and we can figure out what to do next.

-MSK