Re: [Asrg] What are the IPs that sends mail for a domain?

Rich Kulawiec <rsk@gsp.org> Thu, 18 June 2009 20:46 UTC

Return-Path: <rsk@gsp.org>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 541DB28C164 for <asrg@core3.amsl.com>; Thu, 18 Jun 2009 13:46:28 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -6.599
X-Spam-Level:
X-Spam-Status: No, score=-6.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GnPgcWuxXnna for <asrg@core3.amsl.com>; Thu, 18 Jun 2009 13:46:27 -0700 (PDT)
Received: from taos.firemountain.net (taos.firemountain.net [207.114.3.54]) by core3.amsl.com (Postfix) with ESMTP id 386F428C155 for <asrg@irtf.org>; Thu, 18 Jun 2009 13:46:27 -0700 (PDT)
Received: from squonk.gsp.org (bltmd-207.114.17.162.dsl.charm.net [207.114.17.162]) by taos.firemountain.net (8.14.1/8.14.1) with ESMTP id n5IKkdwS027921 for <asrg@irtf.org>; Thu, 18 Jun 2009 16:46:39 -0400 (EDT)
Received: from avatar.gsp.org (avatar.gsp.org [192.168.0.11]) by squonk.gsp.org (8.14.1/8.14.1) with ESMTP id n5IKgM4R016931 for <asrg@irtf.org>; Thu, 18 Jun 2009 16:42:22 -0400 (EDT)
Received: from avatar.gsp.org (localhost [127.0.0.1]) by avatar.gsp.org (8.14.3/8.14.3/Debian-4) with ESMTP id n5IKkXNX013009 for <asrg@irtf.org>; Thu, 18 Jun 2009 16:46:33 -0400
Received: (from rsk@localhost) by avatar.gsp.org (8.14.3/8.14.3/Submit) id n5IKkXpc013008 for asrg@irtf.org; Thu, 18 Jun 2009 16:46:33 -0400
Date: Thu, 18 Jun 2009 16:46:33 -0400
From: Rich Kulawiec <rsk@gsp.org>
To: asrg@irtf.org
Message-ID: <20090618204633.GB12663@gsp.org>
References: <9112777.1871245190785748.JavaMail.franck@iphone-4.genius.local> <4A3864C5.1050006@billmail.scconsult.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <4A3864C5.1050006@billmail.scconsult.com>
User-Agent: Mutt/1.5.18 (2008-05-17)
Subject: Re: [Asrg] What are the IPs that sends mail for a domain?
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Thu, 18 Jun 2009 20:46:28 -0000

On Tue, Jun 16, 2009 at 11:36:37PM -0400, Bill Cole wrote:
> That said, I think that adding DNS records that map specific network  
> addresses to their legitimate behaviors in a generalized model would be a 
> positive advance.

+1.  For instance, I (semi-seriously, semi-facetiously) proposed "XM"
records some years ago, whose value would be 0 or 1: hosts with 1 send
SMTP traffic, hosts with 0 don't.  Thus every MX's behavior could be
to reject all port 25 SMTP connections from hosts with XM=0.

There a lot of problems with this idea, and if memory serves, both
Dave Crocker and John Levine pointed them out at the time.  But I think
that perhaps it's time to revisit the general concept and see if it
could be made to work for (as Bill said) "legitimate behaviors in a
generalized model".  This would not only allow us to address SMTP abuse,
but (for example) zombie hosting of DNS and HTTP servers.

---Rsk