Re: [Asrg] What are the IPs that sends mail for a domain?

Douglas Otis <dotis@mail-abuse.org> Wed, 01 July 2009 19:13 UTC

Return-Path: <dotis@mail-abuse.org>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 2915428C108 for <asrg@core3.amsl.com>; Wed, 1 Jul 2009 12:13:05 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.397
X-Spam-Level:
X-Spam-Status: No, score=-6.397 tagged_above=-999 required=5 tests=[AWL=0.202, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id UmfxtkOgQS8m for <asrg@core3.amsl.com>; Wed, 1 Jul 2009 12:13:04 -0700 (PDT)
Received: from harry.mail-abuse.org (harry.mail-abuse.org [168.61.5.27]) by core3.amsl.com (Postfix) with ESMTP id 96A263A6A8D for <asrg@irtf.org>; Wed, 1 Jul 2009 12:12:56 -0700 (PDT)
Received: from [IPv6:::1] (gateway1.sjc.mail-abuse.org [168.61.5.81]) by harry.mail-abuse.org (Postfix) with ESMTP id CBE1BA94439 for <asrg@irtf.org>; Wed, 1 Jul 2009 19:13:15 +0000 (UTC)
Message-Id: <3F8B6DF0-03CF-4184-BB55-AE30E1E4345A@mail-abuse.org>
From: Douglas Otis <dotis@mail-abuse.org>
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
In-Reply-To: <DC4825E67EC4297FF587671B@seana-imac.staff.uscs.susx.ac.uk>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v935.3)
Date: Wed, 1 Jul 2009 12:13:15 -0700
References: <mailman.5.1245610801.29559.asrg@irtf.org> <4A3F76B8.2030409@terabites.com> <BBBA1F6A3752AE7B96888ECB@lewes.staff.uscs.susx.ac.uk> <4A48FB80.10709@billmail.scconsult.com> <800E7AE85B690B4BAC93F2CD@seana-imac.staff.uscs.susx.ac.uk> <20090630111105.GA12502@gsp.org> <DC4825E67EC4297FF587671B@seana-imac.staff.uscs.susx.ac.uk>
X-Mailer: Apple Mail (2.935.3)
Subject: Re: [Asrg] What are the IPs that sends mail for a domain?
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 01 Jul 2009 19:13:05 -0000

On Jul 1, 2009, at 3:17 AM, Ian Eiloart wrote:

> The point of SPF is to authenticate the sending domain.

SPF(email-address)->pass provides authorization for Outbound MTAs.   
The rationale for offering SPF authorization might be to improve  
message acceptance or DSN rates, as recommended by AOL and MSN for  
example.  It would be risky to conclude SPF(email-address)->pass means  
other domains did not provide assess to the originator of the  
message.  It is fundamentally wrong to hold the wrong entity  
accountable.

> If the IP address is authorised (by the domain owner) to send mail  
> from the sender domain, then bouncing mail into that domain isn't  
> going to be causing backscatter, unless the domain lacks internal  
> controls over message submission. If it does lack those internal  
> controls, then the users of the domain can blame the domain owner.

SPF(email-address)->fail might only indicate a message had been  
forwarded.  Use of RFC 3464 and minimal DSN content with"multipart/ 
report" content types should occur irrespective of the SPF results  
when messages are returned post acceptance.  Nor should one assume SPF  
authorization fairly assigns blame for poor administration of Outbound  
MTAs.  How many ESPs even offer SLAs that ensure domain exclusivity  
when handling tens of thousands of domains?

> I guess there can also be issues where two distinct domains share  
> the same outbound IP addresses, through an email service provider.  
> In that case, the email service provider is the responsible party  
> that needs to be held to account. They need to ensure either (a)  
> separation of domains by outbound IP address combined with accurate  
> SPF records, or (b) proper implementation of MSA on all the domains  
> that they provide service for.

Use of verified EHLO IP address information should only be claimed by  
a _few_ domains over a period of time.  Seeing too many likely  
indicates the presence of a NAT, compromised systems, or both.  The  
domain providing stewardship over access to Outbound MTA should be  
assessed separately from domains that have purportedly originated the  
messages.  Even a cryptographically strong scheme like DKIM will not  
mitigate replay abuse, while it does help mitigate phishing.  On the  
other hand, SPF might enable convincing phish whenever SPF(email- 
address)->pass is assumed to authenticate domain sources.  It does not!

> Backscatter is a problem, but bounce messages do have advantages  
> over 5xx error codes when it comes to communicating with the sender.  
> For example, you can't know what the sending MTA is going to do with  
> a 5xx error code - they might just drop it. DSNs were invented for a  
> reason, and it's a shame to lose them entirely - even when you have  
> reason to believe that the return-path (or at least the return-path  
> domain) isn't forged.

Best practices should reduce DSNs, often by ensuring immediate  
rejection is enabled where possible.   Many of the DSNs from  
legitimate Inbound MTAs occur as a result of valid users not being  
known by border MTAs.  Those appear to be mostly from poorly  
integrated hybrid systems protecting an Exchange Server or offering  
stand-alone inbound filtering services.

-Doug