Re: [Asrg] SPF's helo identity as a reporting target

[Douglas Otis <[e-mail]>]

On 5/14/12 7:34 AM, Alessandro Vesely wrote:
>  On Mon 14/May/2012 16:19:57 +0200 Chris Lewis wrote:
> > On 12-05-14 05:26 AM, Alessandro Vesely wrote:
> >
> >> There must be loads of national laws that the owner of that zone
> >> openly breaks. Isn't that too much risky from a legal POV,
> >> considering its effectiveness is probably less than other kinds
> >> of DDoS?
> >
> > Who said anything about a deliberate DDOS? Think of it as spam
> > with electronic countermeasures designed to confuse, confound and
> > distract the recipients and third parties.
>
>  Whatever the intent, I should get your permission before asserting
>  that your server serves me. Shouldn't I? Then, yes, I suppose some
>  judges still have difficulties understanding Internet protocols.
>
> > Just like they already do.
> >
> > "national laws ... openly breaks". You can say that with a
> > straight face considering that 80-90% of all spam already does?
>
>  I don't have specific experience, but it seems to me that when
>  spammers leave enough evidence behind them they can be taken to
>  court.
>
> >> 220 wmail.tana.it ESMTP
> >
> > Big enough, the recipient site still loses before the 220.
>
>  You're right. Rejecting is cheap, but still bears a cost.

Dear Alessandro and Chris,

Since RFC821, HELO/EHLO was defined as FQDN SMTP hostnames.  There is no 
reason additional policy assertions such as those proposed for DMARC 
could not include authenticated email EHLO/HELO acceptance with a 
hostname from their domain, whether by a forward reference to an address 
list, or an SPF resource record.  The domain validated would be 
determined by the domain of the SPF record and not by an SPF mechanism 
as Chris suggested.  The goal of DMARC is to offer a safe method to 
reject messages in a way not likely to create support calls for 
receivers.  A policy that can be extended to individual SMTP servers 
controlled by domains making compliance assertions should offer safe 
rejections having lower cost than message filtering or rejections based 
on the SMTP mail parameter.  The mistake made by DMARC was not 
considering HELO/ELHO alignment against the parent domain rather than 
the hostname.

Regards,
Douglas Otis.