Re: [Asrg] Greylisting BCP

[Douglas Otis <[e-mail]>]

On 10/18/11 12:42 PM, Daniel Feenberg wrote:
>
>
> On Tue, 18 Oct 2011, Murray S. Kucherawy wrote:
>
>>
>> After some chatter inside MAAWG and on the ietf-smtp mailing list, 
>> I’ve started an
>> outline for a BCP on the practice of greylisting. The main purpose is 
>> to explain
>> what it is, discuss the pros and cons of its variants, and give some 
>> recommendations
>> for implementation and configuration for a few example installations 
>> and policies.
>>
>>
>>
>> The draft (which is currently only an outline) is here:
>> https://datatracker.ietf.org/doc/draft-kucherawy-greylisting-bcp/
>>
>>
>>
>> Comments welcome.
>
> Where should comments go? I have a question really, though it might be 
> construed as a comment. Why do greylisters match on the (sender, 
> receipient, MTA) triple rather on just the MTA? Isn't it nearly 
> certain that if an MTA returns for one sender/receipient pair, it will 
> return for any pair? So that keeping track of all three seems 
> unnecessary and increases the probability of a message being delayed. 
> What am I missing?
Grey listing challenges stateful processing of the sender to test an 
often erroneous assumption that bots sending spam don't maintain state. 
Thanks to grey listing, many bots retry against the same recipients, 
just not always with the same message. Heuristic methods are quickly 
defeated once deployed on enough systems. Defining practices for failing 
concepts seems misguided since such heuristics are likely to make other 
erroneous assumptions related to the nature of the outbound MTA.

We employ temp errors to prioritize limited resources which may delay 
sources with lower reputations. When they are in the middle of some 
campaign, the delay may persist until their run completes. There would 
not be any way to predict how long that might take, nor would any hint 
likely affect the average bulk sender focused on completing their runs. 
We are about to publish a list that categorizes this type of behavior.

I agree it would make more sense to focus on knowing which domain 
_controls_ the outbound MTA without umpteen additional transactions. 
With outbound MTA authentication, receivers would have a sure and robust 
basis for avoiding abusive transactions, where grey listing would be 
considered wasted efforts.

-Doug