[ietf-smtp] Re: Examples of pseudonymous email services

[Hector Santos <[e-mail]>]

> On May 28, 2024, at 12:28 PM, Jeremy Harris <[e-mail]> wrote:
> 
> On 28/05/2024 17:00, Dave Crocker wrote:
>> What are some examples of this being done?
> 
> I can't tell what you asking for with "what are...".

To me, the term “pseudonymous" means there is still accountability with the usage of an obscure user ID. It is not completely hidden, and traceability is available. Therefore, I consider the term more like or closer to “alias” as opposed to a pure “anonymous” ID with little or no traceability.

> The private provider I help operate does it, by adding
> an entry into the DB used for mapping aliases to accounts.
> The receiving MTA uses the existence of an alias for
> deciding to accept or reject inbound messages.
> The MDA uses the mapping to find a file to deliver to.

+1. I agree, it is pretty traditional. In the early days with UUCP, acceptance, rejection, and bounces were all done post-transfer of data. With the introduction of SMTP and its nimbler implementations, we now have the flexibility to use dynamic shims and hooks for immediate RCPT TO: temporary or permanent responses.   Today,  higher overhead SMTP sessions that include:

Connect: IP Geo Location filtering, Rate Limiting
Helo/Ehlo: Stronger Client Host Name filtering
Mail From: SPF checking of the return-path and possibly the Client Host Name
Rcpt To: User DB check for direct vs remote address (requires authorization)
DATA Filtering: DKIM, ADSP, ATPS, DMARC, ARC, “Spam Words” “Spam Assassin” filtering possibilities
(What is your current SMTP session residence time?  .5ms?  1-3 or more secs?)

The Return Path is checked in many ways, with the most successful being CBV (Call Back Verifier). Despite its controversy, it remains effective. However, we still need to address the issue of compliant bad actors. Even if a sender adheres to all rules from SPF to DMARC, anonymous names can still pose a problem.

All the best,
Hector Santos