Re: What I've been wondering about the DMARC problem

[[e-mail]]

> On Sat, Apr 19, 2014 at 8:31 AM, Ned Freed <[e-mail]> wrote:

> >
> > > > >"If the RFC5322.From domain does not exist in the DNS, Mail Receivers
> > > > >SHOULD direct the receiving SMTP server to reject the message."
> > > >
> > > > As far as I can tell, that bit of poor advice hasn't been implemented.
> >
> > > Why is that poor advice?  It's not uncommon for an MTA receiving mail to
> > > confirm that the message is replyable, at least insofar as an A and MX
> > are
> > > available for whatever comes after the "@".
> >
> > It's outrageously poor advice, for the simple reason that there's all
> > kinds of
> > legitimate email that's sent for all kinds of different reasons that you
> > don't
> > want people to be able to reply to. And the sooner they get a failure when
> > they
> > try and reply, the better.
> >
> > As such, the ability to reply to the RFC5322.From tells you almost nothing
> > about its legitimacy.
> >
> > It's yet another case where a failure to consider the multiple semamtics
> > field like RFC5322.From has, and designing to a subset of those designs,
> > ends up screwing things up.
> >

> If you say so, but I can't think of an example off the top of my head.

What planet are you on? I get mail with intentionally invalid From: fields all
the time. The domain usuall (but not always) exists, but the mailbox returns an
error.

I also get mail that says something like "this goes to a mailbox that's
unmonitored" somewhere in the message. But rather less of that.

> Is
> that still a currently-used tactic?  Most of the examples I can think of
> involve a valid address that produces an automated response when someone
> replies, rather than using something that is completely unreachable.

Autoresponders for such things produce blowback spam. Not good. If the mailbox
is valid, it's usually a black hole.

Indeed, while I cannot talk about the details, I know there was a lawsuit
against an ISP that was doing this sort of checking very aggressively and
blocking lots of legitimate email. The ISP lost and was forced to remove this
check.

> I seem to recall common use of From: field validation back when that
> capability was introduced into open source sendmail as an anti-spam tactic,
> though it was never supported by the vendor directly.  Maybe it's less
> common now.

A lot less common. See above.

				Ned