Spam Slows AT&T Email

Spam from Asia? by amorangi · 2002-02-23 00:42 · Score: 3, Funny

Most of it originates in the USA! And you don't know how annoying it is getting spam for USA paraphenalia, gas masks etc when you are not USian!

Re:Spam from Asia? by Khalid · 2002-02-23 01:09 · Score: 3, Insightful

I am in Europe and 99,99% percent of the SPAM I get is from US !
Re:Spam from Asia? by Teun · 2002-02-23 01:49 · Score: 3, Informative

I'm afraid I have to agree, it might have been sent from / through asian servers but the products advertised are near exclusively American. And for the largest part useless and/or unobtainable here in Europe.
What the rest of the world needs is legislation (not only!) in the US against those trying to sell via this irritating system.

--
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Re:Spam from Asia? by Arker · 2002-02-23 02:33 · Score: 4, Insightful

Just goes to show the level of technical (in)comprehension among suits and reporters. Both groups seem to have a difficult time using simple words like "originate" properly.

Most of the spam I get comes *via* asia (with a rising amount coming from Spain and Portugal lately too) because there are a lot of abusable relays in those areas. But the actual *origin* for most of it seems to be some guy with a cable modem in Arizona.

Oh, btw, it's just as annoying getting spam for it when you are here in the USA, spam is just annoying period. The most annoying spam I think is when it's for something I might actually be interested in - because there is no way I'd buy ANYTHING that's spamvertised, so a spammer could actually cause me not to get something I want. That's pretty rare though. I think the last time that happened was probably when I got spammed by a BeOS distributor a year or more back.

--
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Re:Spam from Asia? by Anonymous Coward · 2002-02-23 02:59 · Score: 5, Funny

I don't know why I get the stuff, as I don't speak any Asian languages.
Friend, are you having trouble reading your mail? Did you know that Chinese is spoken by over 1.3 billion people?! Take our quick and easy class today! Just call 800-555-1212 and start learning Chinese, Korean or other Asian languages.
This post is not spam! You received this because you joined the opt-in Slashdot and agreed to receive from other list members. This message is sent in compliance of the proposed bill SECTION 301, paragraph (a)(2)(C) of S. 1618. If you wish to be removed please click on the remove link below - Thank you again for giving permission for us to send you offers we believe will help you succeed. Click here if you no longer want to receive gifts or special offers: http://www.sendmemorespam.com
498731497
Re:Spam from Asia? by _ph1ux_ · 2002-02-23 09:05 · Score: 4, Funny

you're just jelous because in the US we have pills that can make your penis grow an inch a month GARAUNTEED!!! ACT NOW!
.

War on Spam by October_30th · 2002-02-23 00:48 · Score: 4, Insightful

Spammers are mostly American, but they hijack Asian mail-relays that have been left open.

The War on Spam must be fought on several fronts, not just one. These evildoers can be defeated by striking them in American courts and fixing the open-relay problem in Asia.

--
The owls are not what they seem

Designated email deliverer. by satanami69 · 2002-02-23 01:01 · Score: 3, Interesting

The only reason that spam is a problem is because everyone has access to email you at your email address. It's the same problem with your phone. Anyone can punch in your number from their phone and dail you directly.

Your P.O box, however, can only be given mail from the actual Post Office. (I'm making an open-relay analogy) Nobody can walk in from the street and legally place mail into your mailbox. Although using a Post Office type deliverer for mail won't filter any spam, it will keep messages that are sent from outside the "post office" deliverer.

So, we need to decide that email doesn't work for private internet messages and come up with a different tool for getting personal messages online, otherwise we will continue to get spam.

--
I really hate Dan Patrick.

Spam ... by nosfucious · 2002-02-23 01:11 · Score: 5, Insightful

This ongoing 'war on spam' will only really be dealt with when two things happen:

1 Sysadmins living in a 'clue fee zone' must be wised up. This means, amoung other things, more education for sysadmins, better products and documentation, better or more translations of documentation, etc. It should be easy to obtain documentation in your local language. Every HOWTO has to have an accurate, up to date translation readily available. As should documentation for proprietory products.

I don't like viruses nor encourage illegal break-and-enter of another person's computer, but a 'whitehat' virus that shuts down the relay component of an email server would be damn handy.

2 The economics of SPAM must be altered, literally turned on their head. It costs to receive bandwidth, but (generally) little, or none at all. (The obvious exception is when you have a bandwidth intensive site that requires nice fat outward pipes). It costs so little to send, just electricity, enough money for a bulk sender (off the shelf or home brewed) and a net connection. Pay the real cost of outgoing mail and watch the volume of spam decrease to an approximation of zero.

Don't know how this last one will be achieved except via a totally new version of 'the net' (or at least a new set of RFC's).

--
Q:I was listening to a CD in Grip and it sounded horrible! What's up? A:Perhaps you are listening to country music

(Very) Slowly self-healing by LinuxHam · 2002-02-23 01:21 · Score: 3

One good thing to keep in mind is that the more recent default configurations of mailer packages are configured to deny relaying. So as mail servers get updated, reloaded and replaced, the problem of open relays will become much smaller. And the clueless sysadmins will have to learn more about their systems in order to turn that function back on. Hopefully they will have had a good speaking to regarding their decision by then, too.

--
Intelligent Life on Earth

Re:duh, challenge response! by DrSkwid · 2002-02-23 01:22 · Score: 3, Interesting

That way the route of email is from your ISP to their ISP

So I should shut my mailserver off because YOU get too much spam, I think not.

and oh, my ISP made the mistake of having the web server release the /etc/passwd file through an shtml include and now EVERYONE from that ISP is being regularly spammed. Worse bit is I told them about the vulnerability 3 years ago!!

IPs that try to connect more than N times in L seconds.
gosh I'm sure the spammers will never notice that one

I cant get to the hash cash but if it's the old "generate a hash key for each email" it's equally flawed. Spammers have plenty of time

TMDA is one way, to prevent you from seeing spam

--
There are places where the networks are not touching,and there are places where they are-Boeing's Lori Gunter

Any open relay honey traps? by reemul · 2002-02-23 01:25 · Score: 5, Insightful

I've seen code to trap the spiders the spammers use and fill up their databases with crap. What I haven't seen is a honeypot designed just for spammers - a box that *looks* like an open relay, but not only doesn't forward the spam messages, it logs and possibly automagically retailiates against the originator. The anti-spam groups have had good luck attracting spam with email addresses set aside for that purpose, but we need to take it to the next level and have some anti-spam servers. Maybe just a simple bot to start listening on port 25 and responding like known weak versions of sendmail when accessed would do. Any of the mighty code ghods here at /. want to see what they can come up with?

--
You're just jealous 'cuz the voices talk to *me*

Re:Any open relay honey traps? by digitalsushi · 2002-02-23 01:34 · Score: 3, Informative

*shrug* maybe this will help, here

http://www.iks-jena.de/mitarb/lutz/usenet/teergrub e.en.html

--
slashdot: where everyone yells sarcastic metaphors to themselves to understand the issue
Re:Any open relay honey traps? by gewalker · 2002-02-23 01:43 · Score: 5, Insightful

I think this sounds like a great idea.

Then I thought about it for minute, and said to myself -- that just means the spammers will learn to test for honeypotness, and the technology based war just has another exchange, but the war is still ongoing.

My father was a businessman, and he first exposed to the Internetet email concept about 6 years ago when I explained it all to him. His first non-technical question was, "Who pays for the email?" I should have listened to him. Instead, I said that it was basically too cheap to meter, whereas he saw it as a potential for abusive business practices because he remembered history where the first postal service made the recipient of the mail pay for the delivery, but was changed to the sender fairly quicker because of the abuse.

The war on spam is the good war of our generation, but I'm afraid it may be the war of our kids generation too unless we get serious about nuking the spammers.
Re:Any open relay honey traps? by lar3ry · 2002-02-23 04:17 · Score: 3, Insightful
This is a nice idea in theory, but there are some reasons why it won't work:
- Running any open relay, even a honey pot, is probably against most ISP's AUP. Breaking the rules to get to the others that are doing bad things is never a good idea: two wrongs don't make a right.
- Some ISPs use some standard tools to check their customers to see if they are running open relays. If those tools hit a honey pot, the customer who is actually attemping to fight SPAM, will actually receive a notice that they are running an open relay against the AUP, or may even get disconnected without notice.
- As mentioned before, it is simple to check if an open relay is actually a honey pot: have the relay send email to a known location. If the email doesn't get delivered, the spammer will know that something different is happening with this apparent relay, and will just move on to the next one.
Interesting thought, anyway.
--
"May I have ten thousand marbles, please?"

Spam Assassin, netblock ORBS by Cally · 2002-02-23 01:33 · Score: 5, Informative

The most recent Need To Know has a good piece on Spam Assassin which uses a clever points-weighted rulebase and apparently has an excellent accuracy rate. What's more it comes with a ISP-friendly daemon mode. Presumably AOL would have some scalability issues, but I'm sure this is a fixable problem.

The other possibility is a net-block equivalent of ORBS. Some on the Sec-Focus Incidents list (and other fora, over the years) have bounced around the idea of blocking netoblocks who'#s POCs don't work, or who don't have or respond to mail to the RFC-mandated abuse@, security@, hostmaster@,.. standard mail accounts. I'm all in favour. Automate probes, the way ORBS did for anonymous relays. I think this would be a Good Thing. People do have a legitimate need to communicate between Asia, America and Europe: simply dropping everything from .kr is evil and wrong, IMHO.

Finally - y'all know that anonymous HTTP proxies are just as bad, if not worse, than traditional open mail relays? Just testing ;)

--
"None are more hopelessly enslaved than those who falsely believe they are free." -- Goethe

Optionally publish valid mail servers for domains by Anonymous Coward · 2002-02-23 01:39 · Score: 5, Interesting

I often get email where the from domain claims to be yahoo.com, but it was sent via an as-yet un-rbl'd server. As it stands your smtp server will accept a mail from anywhere not in a block list, with no checking on whether the server sending you the mail is a legitimate server for that email's claimed from address.

In the same way that RBLs are published via DNS records, it could be useful to have a scheme whereby for your email domain you can advertise (via dns) what hosts are authorised to send email for that domain.

So a mail comes in from a yahoo.com address, you do a dns lookup on the incoming connections ip address appended to validservers.yahoo.com or whatever the convention decided upon is, and the result would tell you if it's valid. You'd also need a way to check that yahoo.com is actually advertising the valid mail servers (and if it isn't, you failsafe and accept the mail).

This scheme wouldn't be compulsory, and would probably be suited mainly to free email providers, large corporates. The downside of it is that if you have a yahoo.com address, but want to run your own smtp server to deliver your mails, then you'd fall foul of such a system. I don't think that's a biggy though - if you could run your own smtp server, you'd probably not use a yahoo.com address you'd have your own domain :).

While I'm rambling, another system which could be done is a protocol for verifying email addresses (you could also do this via dns too, I guess, but dns is getting cluttered enough as it is). For a given email domain it has an entry (in dns) for an email address verification server. When an email comes in, you check if there's a verification server for the source domain of the email, and if so try connect to it, and then submit the email address for verification. Depending on whether it says yay or nay, you accept or reject the mail. If they're not running a verification service, you just failsafe. I know SMTP vrfy exists, but sites often turn it off, or it doesn't do anything useful as the external server is just forwarding mail, etc etc.

These systems wouldn't be so useful until they got adopted by hotmail.com, yahoo.com, eudoramail.com, aol.com etc, and I'm sure people have toyed with these ideas before and maybe there are downsides which outweight the benefits or maybe someone knows of implementations of such a thing.

AT&T, other ISPs should take advantage of this by Silas · 2002-02-23 02:30 · Score: 5, Informative

I hope that AT&T tells their customers exactly what happened: "your mail was delayed because of spam". This is just the kind of incident that would help educate the masses that spam is a very real problem that needs immediate attention.

I agree with the other posters who note that the economics of Spamming need to be reversed in order to stop it, but I think that, even before that, public opinion needs to be swayed such that it is perceived as a significant problem worth addressing all over the place, not just at one ISP or for one open relay. A lot of people have just gotten used to ignoring/deleting 5, 20, 100 spam messages per day. "It's just part of using the Internet, right?" This needs to change. When things like the AT&T congestion happen, they should be used to get the public a little more outraged.

Korean Spam is the Worst by Nova+Express · 2002-02-23 04:38 · Score: 3, Informative

I think, if anything, the article understates the Asian Spam Problem. Over half of the Spam I get is from Korea, and 90% of that is Korean language spam. I have complained literally hundreds of times to the various Korean Spam domains involved (kornet.net is the worst, but hananet.net, thrunet.com, and dreamx.net aren't far behind), to every "official" e-mail address I could find or think of (see below), all to no avail. In fact, the amount of spam actually increased. If any Slashdot readers actually speak Korean, you might send e-mail to the following addresses and let them know that their spam problem is so bad that rest of the Internet is in the process of blocking all e-mail from all of Korea in response to their sins.

Kornet.net (the biggest offender)

abuse@kornet.net, ip@ns.kornet.net, ip@ns.kornet21.net, domain@NS.KORNET.NET, donghk@soback.kornet.net, ever@kt.co.kr, jeonnam3@soback.kornet.net, jeon@kornet.net, jeonbuk3@kornet.net, koreatelecom@KORNET.NET, gfd5246@soback.kornet.net, gspark@kornet.net, help@KORNET.NET, helpdesk@KORNET.NET, haewha1@soback.kornet.net, heyeunmi@kornet.net, kmhno1@soback.kornet.net, hopewon3@soback.kornet.net, kgromc@soback.kornet21.net, kmhno1@soback.kornet.net, legal@KORNET.NET, network@kornet.net, packet@soback.kornet.net, postmaster@kornet.net, postmaster@soback.kornet.net, postmaster@ns.kornet.net, postmaster@soback.kornet.net, pusanpub@soback.kornet.net, root@soback.kornet.net, root@kt.co.kr, service@kornet.net, support@kornet.net, system@kornet.net, yjjeon61@kornet.net, abuse@ns.kornet21.net, domain@ns.kornet21.net, network@ns.kornet21.net, postmaster@ns.kornet21.net, resume@kornet.net, root@ns.kornet21.net, service@ns.kornet21.net, support@ns.kornet21.net, system@ns.kornet21.net, wong@kornet.net, abuse@ASADAL.NET, postmaster@ASADAL.NET,

Itnsoft.com (the #1 spamvertised Korean domain)

abuse@itnsoft.com, help@itnsoft.com, ip@ns.kornet.net, hostmaster@nic.or.kr, marom@itnsoft.com, postmaster@itnsoft.com, root@itnsoft.com, eglee@yesnic.com, info@yesnic.com, hostmaster@yesnic.com, postmaster@yesnic.com, eglee@whois.co.kr, postmaster@whois.co.kr, whois@whois.co.kr, brkim@INWANG.NOWCOM.CO.KR, domain@NOWNURI.NET, busisik@nownuri.net, kbr@nownuri.net, memory@nownuri.net, abuse@nownuri.net, postmaster@nownuri.net,

DreamX.net (Korean porn spam, mostly)

abuse@dreamx.net, abuse@cjdream.net, abuse@todream.net, admin@dreamx.net, admin@cjdream.net, administration@dreamx.net, administration@cjdream.net, billing@DREAMX.NET, billing@cjdream.net, brkim@cjdream.com, dns@dreamx.net, dns@cjdream.net, dnsadmin@dreamx.net, dnsadmin@cjdream.net, domain@DREAMX.NET, domain@todream.net, domains@DREAMX.NET, domain@todream.net, feedback@DREAMX.NET, feedback@cjdream.net, help@DREAMX.NET, help@cjdream.net, helpdesk@DREAMX.NET, helpdesk@cjdream.net, hostmaster@dreamx.net, hostmaster@cjdream.net, inhanna@cjdream.net, info@dreamx.net, info@cjdream.net, jyan@dreamx.net, jyan@cjdream.net, ley319@dreamx.net, loveabuse@dreamx.net, loveabuse@cjdream.net, mail@dreamx.net, mail@cjdream.net, mgr@cjdream.com, news@dreamx.net, news@cjdream.net, newsabuse@dreamx.net, newsabuse@cjdream.net, postmaster@dreamx.net, postmaster@todream.net, raven3@dreamx.net, raven3@empal.com, root@dreamx.net, root@cjdream.net, soip@cjdream.com, sales@dreamx.net, sales@cjdream.net, sbkim091@dreamx.net, sbkim091@cjdream.net, service@DREAMX.NET, service@cjdream.net, solhan@cjdream.net, spam@DREAMX.NET, spam@cjdream.net, support@cjdream.net, support@dreamx.net, sysop@DREAMX.NET, sysop@cjdream.net, sysop@todream.net, tech@dreamx.net, tech@cjdream.net, technical@dreamx.net, technical@cjdream.net, technicalsupport@dreamx.net, technicalsupport@cjdream.net, system@cjdream.net, system@dreamx.net, sysop@todream.net, ykshin@cjdream.net, ykshin@dreamx.net, eglee@yesnic.com, info@yesnic.com, hostmaster@yesnic.com, eglee@whois.co.kr, brkim@INWANG.NOWCOM.CO.KR, domain@NOWNURI.NET, kbr@nownuri.net, memory@nownuri.net, busisik@nownuri.net, abuse@nownuri.net, postmaster@nownuri.net, inhanna@sysone.co.kr,

Thrunet.com

abuse@thrunet.com, abuse@korea.com, admin@thrunet.com, admin@korea.com, administration@thrunet.com, dns@thrunet.com, dns@korea.com, dnsadmin@thrunet.com, domain@thrunet.com, feedback@thrunet.com, feedback@korea.com, help@thrunet.com, helpdesk@thrunet.com, hostmaster@thrunet.com, mail@thrunet.com, mail@korea.com, news@thrunet.com, news@korea.com, newsabuse@thrunet.com, postmaster@thrunet.com, postmaster@korea.com, root@thrunet.com, service@thrunet.com, support@thrunet.com, sysop@thrunet.com, tech@thrunet.com, tech@korea.com, technical@thrunet.com, technical@korea.com, technicalsupport@thrunet.com, youngkim@thrunet.com, youngkim@korea.com, hostmaster@nic.or.kr,

hananet.net

abuse@hananet.net, bluelinux@hananet.net, domain@hananet.net, domains@hananet.net, feedback@hananet.net, help@hananet.net, helpdesk@hananet.net, info@hananet.net, hostmaster@hananet.net, lee@hananet.net, linux@hananet.net, news@hananet.net, postmaster@hananet.net, root@hananet.net, service@hananet.net, spam@hananet.net, support@hananet.net, system@hananet.net, sysop@hananet.net, tech@hananet.net, technical@hananet.net, webmaster@hananet.net, WooJooLee@hananet.net, WJLee@hananet.net, ysjeon7@hananet.net, bspark@kci.co.kr, bluelinux@YAHOO.CO.KR, abuse@YAHOO.CO.KR, postmaster@YAHOO.CO.KR,

KIDC.NET

abuse@KIDC.NET, billing@KIDC.NET, dnsadm@KIDC.NET, domain@KIDC.NET, guard@kidc.net, helpdesk@KIDC.NET, hostmaster@KIDC.NET, hostmast@KIDC.NET, hjryu@kidc.net, ishan96@kidc.net, postmaster@KIDC.NET, root@KIDC.NET, security@kidc.net, support@KIDC.NET, abuse@BORA.NET, anti1473@bora.net, b4012391@users.bora.net, badmail@bora.net, billing@BORA.NET, dnsadm@BORA.NET, domain@BORA.NET, help@BORA.NET, ipadm@bora.net, ipadm@nic.bora.net, hostmast@BORA.NET, lyt082@bora.net, news@BORA.NET, postmaster@BORA.NET, root@BORA.NET, security@BORA.NET, sysop@BORA.NET, ysjeon7@bora.net, sexxkorea@hanmail.net, abuse@hanmail.net, postmaster@hanmail.net, hostmaster@hanmail.net, abuse@chollian.net, muscle73@chollian.net, zcedomain@chollian.net, znotice5@chollian.net, abuse@kr.iasiaworks.com, postmaster@kr.iasiaworks.com, webmaster@kr.iasiaworks.com, 1004@domain1004.com, I@i1004.com,

--
Lawrence Person (lawrencepersonh@gmailh.com (remove all "h"s to mail)

http://www.lawrenceperson.com/

Re:You were speaking as a dullard. by fmaxwell · 2002-02-23 04:55 · Score: 3, Insightful

One is regulation (which would be cumbersome and probably ineffective, given the global nature of the Internet)

I must disagree. Most spammers are not multi-national corporations trying to attract customers from all over the world. Most spammers have P.O. boxes, toll-free phone numbers, and web sites. Give law enforcement the ability to track these people down, freeze their assets, confiscate their computers, and press charges against them and the spam problem will largely go away. Junk faxes, once a scourge threatening to become as pervasive as spam, has been effectively curtailed with Title 47, Section 227. While there are the occasional junk faxes, the number of them is inconsequential compared to what it was and what it was headed towards.

Technical solutions are being actively developed and some of them are damned effective when installed at a mail server. But such tools, without legislation to address the problem, are analogous to having a bullet-proof vest in a society where it is legal to shoot peopls. Advanced filtering products should be used as an adjunct to tough anti-spam laws, not instead of them.

Re:Blocking port 25 by coyote-san · 2002-02-23 04:56 · Score: 5, Insightful

I'm not sure how this is related to the prior comment....

Anyway, blocking outgoing port 25 is a stupid idea. Many of us work from home and have our own domains, and we legitimately want to have our outgoing mail show our own domains, not @attbi.com or @rr.com or whatever.

There are also some practical problems:

Can we even connect to outgoing mail filters? Some ISPs are switching to web interfaces (think Hotmail or Yahoo mail) and don't accept outgoing SMTP traffic.
If we can connect, do we get mandatory advertising copy inserted? Nothing makes a contract bid look professional like a footer encouraging the recipient to sign up for some cheap ISP. (Even if this isn't common, yet, there can be some weird stuff added or changed in the headers.)
Some misguided sites are now cross-referencing header and DNS information, with the result that anyone using their own domain but their ISP's mail gateway will be blocked as spam. Direct connections stil get through.
Finally, there's the basic concern that the ISP could be logging email sent through their system. Yes I know about encryption, but I also know how incredibly hard it is to get people to use it. With my own mail server I can set up my system to use STARTTLS, but with an ISP mail server I may not have encryption on either leg.

--
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken

20% of all emails... by tcc · 2002-02-23 05:08 · Score: 3, Interesting

See? this is where I think the Gov. is failing. We got something that we all commonly HATE: SPAM.

We have a common target on which we'd love to see some LEGISTLATION against it, for once.

And what is the Gov. doing? Passing laws left and right to protect big corporation, to reduce your rights as consumers, to be a complete pain in the ass and give themselves the right to sue the planet, but what is being done for the VOTERS, the USERS, the people paying the tax dollars?

Well this is one case of an EASY win of public opinion, heck, they could even pass a few bad things without people noticing it because we'd be so impressed that our elected people actually did something for the PEOPLE.

Ok this sounds like I am frustrated against the system but you get the idea... of course a global spam law and action will be taken one day... when all the big corporations will be really pissed. Or major ISP be fed up paying bandwidth for SPAM, Look now AT&T is starting the run, shouldn't take long now before we get something out of this.

I think blocking ASIA would be a good thing, a pain in the start, obviously, but for a good cause, when they'll see they can't conduct buisness properly, they'll move and close those open relays and hey, screw human rights on spammer, you can KILL the biggest of them and I don't see anyone here who'll be really upset, for once :).

Spam is doing 20% of the global traffic, the numbers are about right with what I see in my mailbox, as for my hotmail mailbox though, it's more like 95%.

--
--- Metamoderating abusive downgraders since my 300th post.

Re:Not a problem by erroneus · 2002-02-23 06:29 · Score: 3, Informative

I beg to differ with you on many points:

FIRST! Filtering at the receiving end is not the answer... at least not the whole answer and doesn't address all the other problems. The filter does not prevent the use of bandwidth!! It merely prevents the packets from being processed beyond initial reception and inspection. So the badthwidth is still being eaten.

SECOND! As another reader/writer has commented, in order to own an internet domain, a valid email address MUST be supplied. This is completely unavoidable. And simply being 'vulnerable' is not an excuse or justification for someone else to unfairly exploit your resources!!!

I also use ATTBI but I don't use the email service they provide. I guess it means I don't get the updates, bulletins and other information but asside from having essential connectivity, I get my services from elsewhere. I'm very happy with that arrangement.

Problematic for many users by Corgha · 2002-02-23 07:14 · Score: 3, Insightful

The downside of it is that if you have a yahoo.com address, but want to run your own smtp server to deliver your mails, then you'd fall foul of such a system. I don't think that's a biggy though - if you could run your own smtp server, you'd probably not use a yahoo.com address you'd have your own domain :).

Actually, this is a pretty big downside for many users. Every once in a while, someone proposes a similar scheme that makes it hard or impossible to "forge" From addresses. This is not exactly that, but it's close enough. The problem is that this is a perfectly legitimate and necessary use of email, and is, in fact, discussed in RFC 822.

The basic problem is that many of us wear quite a few different hats, each of which has one or more email addresses. Suppose I want to send an email using my personal address while I'm at work, or my work address while I'm at home. Suppose I need to reply to some email sent to an official address using that official address as the header From, and that I also want bounces to go to that address so that others at that address can see if my reply was not sufficient (requiring a change in the envelope From). Maybe I do run my own smtp server and domain, but I want to use my spam-trapping yahoo address to reply to yahoo mail (for privacy reasons), and I want to use mutt instead of some stupid web interface. Maybe I'm a sysadmin who wants to set up a number of forwarding addresses (perhaps official addresses for some project on some domain). Now my one-way service has to be a two-way service; instead of just editing the aliases file, I have to set up an account for each of the people who needs to send mail. These are just some of the things that I happen to do on a daily basis and that adoption of your system might make impossible or more of a pain.

Sure, a lot of times this can be solved by some sort of remote access or SMTP auth, but it would certainly be less convenient (especially because some sites are difficult to access remotely). The bigger problems are social: many of the users I know who do these sorts of things aren't the most technically-savvy; many domains are unlikely to introduce the features necessary for full remote access (so then it becomes less of an inconvenience and more of a loss of service).

The good thing about your proposal is that it's opt-in for the sender's domain (whereas most others are opt-in for the recipient's domain), and it therefore gives a domain more control over its email addresses (as opposed to less with other schemes). It allows example.com to say "we want mail from addresses in our domain sent out via only our servers." Presently, anti-relaying provisions in servers make it possible to say "we want only mail from addresses in our domain sent out via our servers." This just completes things.

I guess it depends on your perspective. As a sysadmin, I'd be happy to have the power to turn this on for my domain (though I probably wouldn't, and other domains might not use it -- look at how terrible people are with MX records). As a user, I'd be unhappy if one of my sysadmins turned it on, but happy if some of the domains spammers use and I don't use turned it on. I guess it might be sort of a "not in my backyard" issue, which might limit its adoption. Another problem might be sysadmins that block domains which don't have these records, thus taking the power away from the sender's domain again.

While I'm rambling
While I'm ramblingly replying:

When an email comes in, you check if there's a verification server for the source domain of the email, and if so try connect to it, and then submit the email address for verification. [...] I know SMTP vrfy exists, but sites often turn it off

They turn it off because it can be abused by spammers looking for valid addresses or is in some other way a privacy concern. What you propose is functionally equivalent to VRFY (except that it can run on a different server), so I doubt it would be turned on either. However, it might not be a bad thing for servers to *try* to VRFY an address, and only block if VRFY returns "no such user" (not "permission denied"). If a separate protocol and server is desirable, there is always good old finger (though it's maybe a little too free-form), but VRFY makes more sense, as the primary mail servers should know to whom they can deliver mail.

24 of 272 comments (clear)