Re: [Asrg] DNSBL and IPv6

[Paul Smith <[e-mail]>]

On 25/10/2012 15:37, Emanuele Balla (aka Skull) wrote:

> For point 1, there will be a limit to this change rate, at least when we
> speak about bots, and it's even been cited here already: a single
> machine can't use too many addresses without saturating its router
> neighbor table.
> Which is a valid esteem for the number of different IPs the
> IPv6-address-change-mechanism will be able to use effectively, then?
> Truth is we don't know for sure...
Hmm - I've heard talk about this problem of saturating the router 
neighbour table. To be honest, I'm not entirely sure what a 'neighbour 
table' is... But, why would people have a /64 block if the router can't 
cope with it?

>> I know this isn't an ideal solution either (one weakness is that it
>> >allows you to DDoS an MTA by sending large numbers of messages with
>> >an invalid signature), but perhaps it's better than trying to make
>> >IP-blacklists work over IPv6? Or perhaps someone can come with a
>> >better X now that MTAs can still afford to tell IPv6-senders "do X or
>> >retry over IPv4".
> Could be. We just need to find out a good X then
Rather than using DKIM, why not use client certificates keyed off the 
sender domain. That way you don't need to get the message content.

It would require TLS for all IPv6 MTA-MTA connections, but given that 
'old' servers won't support IPv6, and new ones 'should' support TLS, 
that shouldn't be an insurmountable problem. It would also mean that a 
sending MTA couldn't send to the same target MTA using the same 
connection for different sender domains. This wouldn't be a problem for 
small->moderate sized MTAs.

I suppose it's only the big MTAs (google et al) who would suffer a bit 
because of something like this, but then, if it cut down on the spam, 
they'd probably gain more than they lost.

The problem is that certificates on their own (like DKIM) won't 
necessarily reduce spam, just spoofing. So, there'd need to be some way 
of linking reputation to domain, but that would be the same with DKIM.




-

Paul Smith Computer Services
Tel: [phone]
Vat No: GB 685 6987 53