[Techtalk] bogus bounces--WTF?

[Maria McKinley]

Miriam English wrote:
> Maria McKinley wrote:
> 
>> Regarding Miriam's mail, the major problem with what you are suggesting 
>> is that it assumes that all legitimate mail servers are configured 
>> correctly, which is unfortunately far from true. It is actually possible 
>> to configure spamassassin to do a reverse DNS to check the HELO 
>> identifiers, but you have to be careful with this configuration, because 
>> like I said, you can easily hit legitimate mails.
> 
> Hi Maria,
> 
> Thanks for the reply. I'm not really assuming anything about current 
> mail servers. My suggestion would involve an alteration to the mail 
> server so that it kept checksums of all sent email till either a 
> confirmation was requested or some timeout (perhaps a couple of months) 
> elapsed.
> 
> The new spam-immune email servers could happily replace current 
> spam-prone email servers with zero effect on ordinary email recipients, 
> but it need not replace the current system; it could operate alongside 
> it. I expect a lot of people would simply switch over to the spam-free 
> version pretty quickly and current systems would fall into disuse pretty 
> quickly. Who wants spam? People running big servers would be very happy 
> to change as the bandwidth required would drop pretty dramatically (I 
> generally get far more spam than genuine email in one of my old 
> unfiltered email accounts, and if attachments used a sensible binary 
> transfer bandwidth for those would drop too).
> 
> If the new spam-immune email servers were configured incorrectly (for 
> example using wrong headers) then email simply would not work. There is 
> nothing particularly inconvenient about this. Any admin needs to pay 
> attention to setting up a system correctly so that it works. If the 
> current system sends email with bad headers then when people find they 
> can't get through to people as more and more people move to spam-immune 
> systems then I don't see that as a problem. We are already seeing a 
> gradual loss of email anyway, as people lose genuine email in the deluge 
> of spam, or they are accidentally filtered out because of keywords, or 
> they get incorrectly blocked when their address is misidentified as a 
> spammer, or their domain gets blacklisted because of some spammers using 
> the ISP.
> 
> Remember that spam is far more than just an inconvenience and waster of 
> net traffic. It is a major method of account theft, virus and trojan 
> distribution, and running scams.
> 
> This tiny little, simple change would fix almost all that.
> 
> Best wishes,
> 
> 	- Miriam
> 

I understand what you are suggesting, and there is already some movement 
to do this.

See the section Authenticating senders in this wikipedia article:

http://en.wikipedia.org/wiki/E-mail_authentication

Specifically, DKIM uses something similar to what you are proposing:

http://en.wikipedia.org/wiki/DKIM

Requiring that you can/must authenticate the server that the mail came 
from is a necessary first step to authenticating a particular email. I 
was explaining the difficulty in this first step, but in the scenario 
you have imagined implementation becomes even more difficult, because it 
not only requires mail servers to be configured correctly, but to 
provide extra services as well. It is unfortunately not quite as simple 
a change as you seem to believe. All parties must agree as to what 
constitutes verification, how to ask for it, etc, ie. the standard 
protocol for such a transaction, and must set up the services to send 
and receive the verifications.

It is sort of a chicken and egg problem. If no one is requiring that I 
set up a service to confirm that I sent a mail, than I am unlikely to do 
so, especially because there is no guarantee that it will be useful, 
unless everyone else has already agreed to do the same thing. Enough 
very large players have to agree to the standards for it to be truly 
useful, and so far this hasn't happened. Although there is the goal that 
it will decrease my bandwidth usage eventually, during the time that I 
am verifying many of the emails I am sending, but unable to verify 
enough emails I am receiving to filter on that, I am increasing my 
bandwidth, not reducing it. And there is the additional database 
storage/access necessary to implement such a design.

There is another problem, and that is that spam has to be illegal. 
Otherwise spammers can set up their mail servers to authenticate their 
emails just like any other mail server. It does make life more difficult 
for them, since it may be a little more difficult to switch hostnames as 
often as is necessary to stay off the spam blocklists, but I'm sure they 
would find a way around that.

cheers,
maria