Re: [Asrg] SPF's helo identity as a reporting target

[Chris Lewis <[e-mail]>]

On 12-05-12 03:59 AM, Alessandro Vesely wrote:
> This probably belongs to ASRG, not only because MARF has finished, but
> also because a *Taxonomy of reporting targets* should be hosted
> somewhere, and I'm unable to think of a better place than this list's
> wiki.
> 
> Opinions?

It would be nice if it could be made usable.

This would tend to make a large organization having all of their servers
helo exactly the same way, which flies in the face of industry BCP (eg:
MAAWG), and even if it wasn't specifically RFC5321-illegal, clearly
violates its intent.

Or they use wildcarded MXes.  Ick.  Makes "divisional" abuse addresses
very difficult.

Or use the registration level domain (lop off the non-registration level
FQDN qualifiers) - makes "divisional" abuse addresses impossible, and
the registration level domain chop is real hard to do with some tlds.

The absolute death of this proposal is, tho, that it puts the abuse
reporting address under the control of the spammer and becomes a DDOS
weapon.

I could just see it - it gets implemented for tana.it, and the next
day's blast of 10 billion cutwail botnet spams uses "HELO tana.it".

Kaboom!!!