Re: [ietf-smtp] EHLO domain validation requirement in RFC 5321

Sam Varshavchik <> Sun, 04 October 2020 23:09 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 810663A0A6E for <>; Sun, 4 Oct 2020 16:09:06 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -1.9
X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id 3S0yJgF3z6wW for <>; Sun, 4 Oct 2020 16:09:05 -0700 (PDT)
Received: from ( []) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 050943A0A6A for <>; Sun, 4 Oct 2020 16:09:04 -0700 (PDT)
Received: from ( [::ffff:]) (TLS: TLSv1.3,256bits,TLS_AES_256_GCM_SHA384) by with UTF8ESMTPS id 00000000002A0127.000000005F7A560D.000049C9; Sun, 04 Oct 2020 19:09:01 -0400
Received: from (localhost []) (IDENT: uid 1004) by with UTF8SMTP id 000000000001C7C0.000000005F7A560D.000077DB; Sun, 04 Oct 2020 19:09:01 -0400
References: <20201004214603.5C63B22EE214@ary.qy> <>
Message-ID: <>
From: Sam Varshavchik <>
Date: Sun, 04 Oct 2020 19:09:01 -0400
Mime-Version: 1.0
X-Mime-Autoconverted: from 8bit to quoted-printable by mimegpg
Content-Type: multipart/signed; boundary=""; micalg=pgp-sha1; protocol="application/pgp-signature"
Archived-At: <>
Subject: Re: [ietf-smtp] EHLO domain validation requirement in RFC 5321
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Discussion of issues related to Simple Mail Transfer Protocol \(SMTP\) \[RFC 821, RFC 2821, RFC 5321\]" <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 04 Oct 2020 23:09:07 -0000

Keith Moore writes:

> On 10/4/20 5:46 PM, John Levine wrote:
>> *  Do not host your email system ‘in the cloud’
>>> I'm not sure what this actually means or why it's still a bad idea.
>>> Cloud hosting makes a lot of sense for various reasons.
>> It's a bad neighborhood, since you can expect your neighbors to be
>> poorly managed botted spam-spewing web servers. It varies by cloud
>> provider but the median is pretty bad.
> Is it really fair to assess senders based on their "neighborhoods"?    At

Life's not fair.

Whether it's fair, or not, if someone wishes to evaluate an individual IP  
address based on its "neighborhood", a.k.a., the hosting provider, it is  
their prerogative to do so. Their mail server, their rules.

Or, if someone decides to willingly outsource their evaluation to a third  
party provider, it is their prerogative to do so as well.
> what point does this depart from common sense and into the realm of pure  
> prejudice?  ("That IP address is from across the tracks, which is a bad part  
> of the net.")

Yes, it is prejudice. So?

I'm prejudiced against Chinanet, China Unicom, Digital Ocean, and a few  
others. All I see from those providers are dictionary attacks, and spam. And  
no response to abuse complaints. So, goodbye. Is it fair to the lessors of  
the IP addresses that do not launch dictionary attacks or spam outbursts?  
Yes, it's unfair. Well, that's life. Sorry. I don't have to the time to keep  
track of bad IPs, on a one by one basis. I have other things that are more  
important on my priority list.

There happens to be some entities who do not like the side of railroad  
tracks that I live in, by the way. Or, they outsource their mail filtering  
to third parties that carry that opinion. I never whined about how unfair it  
is. And it never entered my mind to complain to them as well. I recognized  
that it's their mail server, their rules. They are free to take care of  
their business, and I'm free to take care of mine, in whichever way I see  

> In most respects outsourcing of server provisioning, maintenance, and  
> connectivity has become normal, widely accepted, often recommended  
> practice.   Why should email be different?

Who said it should be?

> It's hard to escape the impression that a lot of spam filters are based on  
> imposing completely arbitrary restrictions on senders, on the belief that  
> "good senders" will know which hoops they have to jump through (and have  
> sufficient funding to do so) while "bad senders" won't.

Yes, they may seem to be arbitrary to an outside observer. But, they must  
have merit to whoever is using that spam filter. If it didn't have any  
merit, then they would not be put into place, by definition. And the only  
ones whose opinion counts, with respect to their mail server, is them. If it  
makes sense, to them, to enable EHLO domain verification (dragging this  
subject matter back into the thread kicking and screaming), then they're  
going to do that no matter what verbiage remains in the successor to RFC  
5321. You can take that to the bank.