Re: RR DNS and spam

[Dean Anderson <dean@av8.com>]

There have been several proposals along this line (notably, DNS
Whitelists). These have tended to fail for the same reasons as blacklists:
Administrative variation, revenge use, and other reasons.

Some people will undoubtably pick it up. Not everyone will. So it won't be
much use.  Further, spammers are authorized to use their ISP's mail
relays. Most spam comes directly. KLEZ virus infections, which are
responsible for increasing amounts of spam, use the infected users mail
relay.

Spam is a problem of authorized, but inappropriate behavior. People keep
trying to find ways to identify spam using an authorization process. All
spammers are authorized users of some ISP.  They remain authorized users
until their ISP cancels their account.  There is no way for outsiders to
obtain control over who is authorized by another ISP. Any such controls
are themselves subject to abuse.



		--Dean

On Thu, 3 Apr 2003, Markus Stumpf wrote:

> Over in the IRTF ASRG group I made a proposal to get rid of all the
> spam that comes via abused (proxies etc.) workstations.
>
> My idea was to "mark" hosts in RR DNS zones als being a mailserver by
> (e.g.) adding a TXT record like
>
> 8.0.30.195.in-addr.arpa		IN	PTR	mail.space.net.
> 				IN	TXT	"mailto:abuse@space.net"
>
> That way the maintainers of the RR zone could authorize IPs to be valid
> mailservers and receiving mailservers would only accept mails from
> sending IPs that have the RR TXT record.
> It would be easily implemented, existing DNSBL code could be used by using
> "in-addr.arpa" as a base and inverting the meaning of "there is a TXT
> record".
> A non existant TXT record in RR DNS could be "overridden" by
> - a proper authentification (e.g. SMTP AUTH) so roaming users would bot
>   be locked out.
> - local configuration that lets smarthosts accept emails from "well
>   known" hosts without making that hosts sending mailservers to the public.
> The TXT record could carry a contact address (mailto, http) for abuse.
>
> And now my question to this audience :-)
> With all the recent discussions about the in-addr.arpa zone and reverse
> IPv6 resolution, would such a proposal be accepted by the DNS operators?
> Would they be willing to "change mind" and take more care of reverse zones?
>
> 	\Maex
>
> --
> SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
> Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
> "The security, stability and reliability of a computer system is reciprocally
>  proportional to the amount of vacuity between the ears of the admin"
> #----------------------------------------------------------------------
> # To unsubscribe, send a message to <dnsop-request@cafax.se>.
>

#----------------------------------------------------------------------
# To unsubscribe, send a message to <dnsop-request@cafax.se>.