Re: [Asrg] What are the IPs that sends mail for a domain?

[Bill Cole <[e-mail]>]

Alessandro Vesely wrote, On 6/30/09 3:42 AM:
> Bill Cole wrote:
>> 1. There is no working global mechanism for identifying an accountable
>> party (i.e. one who explicitly *accepts* accountability) from an IP
>> address, due largely to the political and historical variations in how
>> IP addresses have been allocated.
>
> At a first glance, this may seem a flaw in the rDNS/whois systems. Upon
> reconsideration, I realize I have no means to accept accountability for
> an IP address of mines, since SPF or CSV/CSA only convey authorization
> for using a name. In facts, we don't even have a term for "the
> accountable party related to an IP address".

See RFC1183, which defines the "Responsible Party" RR type (RP). It states 
that a RP record can be associated with any node in the DNS hierarchy, and 
of course in-addr.arpa is part of the DNS hierarchy.

RP records are rarely published, and their operational use is even rarer. In 
my experience, RFC1183 is referenced most frequently as a caution against 
expecting too much from the RFC process.

> Dave's Email Arch mentions an Originator as "accountable for the message
> content", but doesn't relate it to an IP address. Rfc5068 associates
> accountability after submission with traceability features of the MSA,
> apparently suggesting that the first relaying thereafter is from an IP
> which is (indirectly) accountable for the message content. Reasoning by
> induction on the hops, one may conclude that all relays using a
> smarthost are accountable: smarthosts require either IP/firewall
> configuration or authentication (assuming they are not open relays.)
> Accountability breaks at the MX-driven relay, often referred as "boundary".

My reason for citing the IP address is that the IP address of the immediate 
client is the only fact that a host acting as an MX can trust to any useful 
degree for every message offered to it. Absent a means of reliably and 
quickly identifying a responsible party from *any* legitimate client IP, the 
suggestion that every MUA might be its own MSA is irrelevant.

>> Funneling email through MSA systems run by providers that in principle
>> have some means of holding their users accountable and are capable of
>> at least understanding bad behavior in mail if not always keeping it
>> controlled is the best partial workaround we have, and it implies the
>> need for domain-level accountability or its equivalent.
>
> Why is it partial?

Because all it does is narrow the population of legitimate MX clients to a 
set that are more likely to have some responsible party identifiable by some 
means. Yet at the same time, the responsible party for a outbound mail 
server handling mail from many ultimate originators may well simultaneously 
reject full responsibility for spam it transports and refuse to identify the 
ultimate originator. The best examples of this for me are the big freemail 
providers, all of whom seem to have shunned the entire notion of 
accountability.

> "Domain-level accountability" is a good approximation.

Only in a relative sense. In an absolute sense, it has proven rather poor.

All it takes for domain-level accountability to fail is a big enough domain.

 > However, a
> smarthost is not necessarily within the same domain (e.g. ukisp.com is
> not even in the same 1st level domain) or the same organization. How
> does accountability degrade through indirection? That is, would you
> trust an SMTP client the same if it relays on behalf of some other party?

Of course not.