Re: Trouble with Sender Authentication

[Douglas Otis <dotis@xxxxxxxxxxxxxx>]

On Nov 6, 2006, at 2:06 PM, wayne wrote:

> In <CA634898-FCE8-4787-B860-669C685272D0@xxxxxxxxxxxxxx> Douglas  
> Otis <dotis@xxxxxxxxxxxxxx> writes:
>
> > Review the archive and you'll find a posting of the agreement  
> > initially required before subscribing to spf-discuss.  While it  
> > may have changed, this was the reason for not participating on  
> > that  list. The MARID list is still functional.
>
> Yes, I saw your post.  People pointed out to you that you were  
> wrong back then, and you are still wrong today.
>
> Constructive critisism is on-topic for the spf-discuss list.  So is  
> the promotion of SPF.  I have removed the suggestion that if you  
> think SPF is fundementally flawed that you should come here instead.

It seems this suggestion is still remembered, judging by advice given  
K.J.  There is not much point arguing about which list.  Something  
other than SPF must be considered as a solution.  Promotion of SPF  
effectively thwarts any consideration of alternatives on spf- 
discuss.  : (

> > > It wasn't until your -01 version of your draft that you actually  
> > > presented hard data in your Appendix A.  Your data doesn't back  
> > > up your 1000x claims.
> >
> > 45 pages in the addendum trace SPF resolving a single name at  
> > about 64:1 increase in traffic.
>
> Nice to see that you agree that your data doesn't back up your  
> claims, but even your 64:1 number is bogus.

How so?  The number assumes a local DNS resolver is seeded with  
attacking SPF script and MX records.  The same SPF script can use  
local-part macros to generate any number of attack queries.  The MX  
records can repeat following a negative caching interval.  The 64:1  
gain is based upon the email itself and just _one_ instance of SPF  
being executed.  The message overhead likely represents spam that  
would have been sent anyway.  The entire SPF related traffic  
represents a gift given an attacker by those executing SPF script. : (

The higher gains noted recognize compromised systems might utilize a  
provider's SMTP server.  The message can include a number of  
recipients as yet another multiplier.  In addition, each message  
might be assessed at multiple locations.  Each instance represents a  
multiplier of network network traffic generated by SPF script.  Just  
8 recipients evaluated at the MTA and MUA reach the gain of 1000:1.   
The local-part macro also facilitates canvassing recipients that make  
use of SPF, and those that do so twice. : (

-Doug