Re: [dispatch] FYI draft-levine-mailbomb-header-00 (fwd)

"John R. Levine" <> Mon, 13 November 2017 01:58 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 09F83128656 for <>; Sun, 12 Nov 2017 17:58:02 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2
X-Spam-Status: No, score=-2 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1536-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id vlXHZFZkdJrH for <>; Sun, 12 Nov 2017 17:57:58 -0800 (PST)
Received: from ( [IPv6:2001:470:1f07:1126:0:43:6f73:7461]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 16A63127B73 for <>; Sun, 12 Nov 2017 17:57:54 -0800 (PST)
Received: (qmail 37142 invoked from network); 13 Nov 2017 01:57:54 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple;; h=date:message-id:from:to:subject:mime-version:content-type:content-id:user-agent; s=9114.5a08fc22.k1711; bh=Y0Ax2RzJeu8SakvWmpitlin1RN9ck2tocuCkl3uOfCU=; b=gtWjR4LonYWWTWsKSwfISvjqyJWtR0EyvfkYVMuBAJc+Rg2kjpz9xn6s0xP1lrMIT6nWiD+KLzfO7CTcrHZcDiHAsXKo5G8DW1AY29sG27h8eGThKK1Td7M6Il9SrB6pXxQc5VA+IOgL7rddS4zavGj7bl7Pv45tOI+vXJHKFvqLC3Zd41bnBqPhdaJBlTt9UYCv+PwN1xHkJLrEd99cLrX4VnxKGtpaItHiTS41Mjp4qA11L0QB8ej8IKcvbZrE
Received: from localhost ([IPv6:2001:470:1f07:1126::78:696d:6170]) by ([IPv6:2001:470:1f07:1126::78:696d:6170]) with ESMTPS (TLS1.2/X.509/AEAD) via TCP6; 13 Nov 2017 01:57:53 -0000
Date: Mon, 13 Nov 2017 09:57:50 +0800
Message-ID: <>
From: "John R. Levine" <>
To: Dispatch WG <>
User-Agent: Alpine 2.21 (OSX 202 2017-01-01)
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="0-821259074-1510538240=:6356"
Content-ID: <>
Archived-At: <>
Subject: Re: [dispatch] FYI draft-levine-mailbomb-header-00 (fwd)
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: DISPATCH Working Group Mail List <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Mon, 13 Nov 2017 01:58:02 -0000

On Mon, 13 Nov 2017, Sean Leonard wrote:
>  Did this draft get followed up on?

Not yet, but Gmail and others M3 people are implementing it.  After next M3 I 
will bring it back with reports from the field.

>  I think it’s a good idea. I have seen form submission systems include this
>  information in e-mail payload data, so there is a use case.
>  I do not share the privacy worries: if the system does not want to include
>  it, it does not have to. It is up to the system and the local regulations
>  under which it operates.
>  Other than the obvious need to clarify the ABNF, I think that it would be
>  reasonable to reuse some syntax from another Internet standard for IP
>  addresses, to handle “IPvFuture” (see, e.g., RFC 3986;
>  General-address-literal of RFC 5321, etc.) without needing to update this
>  document. On the other hand, if you take the exact syntax from another
>  Internet standard, you may not be able to redact the IP address so easily:
>  the ABNF would be different so the implementation would also be different.
>  Sean
>>  On Jun 21, 2017, at 2:27 AM, John R Levine <> wrote:
>>>  For v6, how much would typically be redacted ?
>>  I get the impression it'd usually either be the high half or the low half.
>>  We worked this out with some German ISPs who had strong opinions about what
>>  they would be allowed to include.
>>  Keep in mind that the alternative to a redacted IP is not a full IP, it's
>>  no IP at all.
>>  R's,
>>  John
>>>>  On Jun 19, 2017, at 11:42 AM, John Levine <> wrote:
>>>>  This draft came out of a discussion last week at M3AAWG.  The issue is
>>>>  that bad guys (or more likely bad bots) fill out web forms and include
>>>>  fake mail addresses, the forms provoke confirmation mail which then
>>>>  mailbombs the address(es).
>>>>  This draft adds a new header to indicate that a message is in response
>>>>  to a form submission:
>>>>  Form-Sub: v=1; ip4=198.51.x.x
>>>>  The IP address is that of the web client, which may be partly redacted
>>>>  with "x" for privacy reasons.  If a recipient mail system sees too
>>>>  many of them, it may block the system that's sending them.  The draft
>>>>  also asks for an enhanced status code which means we rejected this
>>>>  message because it's part of a flood with Form-Sub headers.
>>>>  When we had the discussion there were people from at least two large
>>>>  consumer mail systems and a dozen hosters and (sending) mail service
>>>>  providers in the room, so it is likely this will be implemented
>>>>  enough to see if it's useful.
>>>>  At this point the main point of writing the draft was to have a
>>>>  reference so I could ask IANA to register the header and status code.
>>>>  If it does turn out to be useful I'll come back and ask for it to be
>>>>  dispatched into a standards track document.
>>  _______________________________________________
>>  dispatch mailing list

John Levine,, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail.