Re: [Asrg] ARF traffic, was Spam button scenarios

Steve Atkins <> Tue, 09 February 2010 19:24 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id AE4ED3A75A8 for <>; Tue, 9 Feb 2010 11:24:29 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -6.458
X-Spam-Status: No, score=-6.458 tagged_above=-999 required=5 tests=[AWL=-0.015, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, SUBJECT_FUZZY_TION=0.156]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id LlFiEKpRShlr for <>; Tue, 9 Feb 2010 11:24:29 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 008D13A742D for <>; Tue, 9 Feb 2010 11:24:29 -0800 (PST)
Received: from ( []) by (Postfix) with ESMTP id 79F1C4F853C for <>; Tue, 9 Feb 2010 11:25:36 -0800 (PST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Apple Message framework v1077)
From: Steve Atkins <>
In-Reply-To: <>
Date: Tue, 9 Feb 2010 11:25:36 -0800
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <> <> <> <> <> <> <>
To: Anti-Spam Research Group - IRTF <>
X-Mailer: Apple Mail (2.1077)
Subject: Re: [Asrg] ARF traffic, was Spam button scenarios
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <>
List-Id: Anti-Spam Research Group - IRTF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 09 Feb 2010 19:24:29 -0000

On Feb 9, 2010, at 11:20 AM, Alessandro Vesely wrote:

> On 09/Feb/10 19:29, Chris Lewis wrote:
>> Alessandro Vesely wrote:
>>> form abuse@domain is standardized by rfc 2142. Some people (e.g.
>>> Abusix) may plan to send machine generated complaints at such addresses.
>> And they'll learn very very soon that that doesn't work.
>> Been there/done that in a limited fashion, and even in that limited
>> fashion, it don't work.
> Why not, _what_ goes wrong?
>> Do NOT assume that TiS buttons have anything to do whatsoever with
>> RFC2142, standardized role accounts, or whois "abuse-mailbox" entries.
>> Filter tuning doesn't, nor do FBLs (ARF'd or otherwise). While abuse@
>> _may_ get derivations of TiS reports via ARF in some specific cases that
>> are pre-arranged in advance, in no sense should we encourage such role
>> accounts to be target for a raw MUA (or even MTA) stream of complaints.
> It seems to me that a simple filter could determine ARF/non-ARF quality of a message in a fraction of the time that spamassassing would take to process it, assuming abuse@ boxes are whitelisted.

You (and others) are obsessing about the MIME format of inbound email, which is something of a scarlet fish.

Any real ISP is going to be getting ARF formatted reports from all over the place, most solicited, some not. So it's not really much more meaningful than the mail coming in as MIME or in German, or with an attachment.

What you need to be able to identify is who sent it to you, for what purpose, under what agreement and what you need to do with the data in it. Those are entirely orthogonal to the trivial implementation detail of the MIME structure of the email. Once you've done that, then you know what you need to do with the mail, and the details of how it's formatted become relevant.