Re: [apps-discuss] Comments on draft-ietf-appsawg-greylisting-03

["Murray S. Kucherawy" <[e-mail]>]

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of SM
> Sent: Thursday, February 16, 2012 8:34 PM
> To: [e-mail]
> Subject: Re: [apps-discuss] Comments on draft-ietf-appsawg-greylisting-03
> 
> >That is, if a client does 421 and dumps the connection, versus doing
> >450 but keeping the connection open (but probably unable to do
> >anything), I don't see the benefit of the latter for either party. Are
> >you presuming that the 421 comment will be generic while a 450 might be
> >descriptive?
> 
> If the SMTP server sends a 421, it would force the connection to close.
> The usual implementations usually provide some text with the 450.  The
> 421 comment I have seen was generic.
> 
> I'll presume that a 421 means "service unavailable" as described in RFC
> 5321.  BTW, 421 is sometimes used for load shedding.

I don't think we can make the presumption that the text accompanying 421 will be more or less descriptive than the text accompanying 450.  The implementation will decide in either case.  Proscribing use of 421 by itself won't compel implementers to make the 450 text more helpful.

So the question comes down to whether or not the implementer wants to dump the connection or let it linger.  There's also the common argument that if you've decided to greylist a client because it might be a spammer, you probably don't want to be helpful to it at all anyway.

I'll try to come up with some text that walks the line between the two perspectives.

> >    An Applicability Statement specifies how, and under what
> >    circumstances, one or more TSs may be applied to support a particular
> >    Internet capability.
> >
> >I would say abuse mitigation qualifies as a "capability".
> 
> Local policy in SMTP provides leeway.  It can be used for abuse
> mitigation.  In my opnion, that's not an Internet capability.

Since the work of greylisting involves an altered but still interoperable interaction between clients and servers, I believe it does qualify.

Do others want to weigh in on this?

-MSK