Somehow, yesterday I experienced a new form of email nonsense.

[ryanc@infosec.exchange]

@kevinbowrin I mean, there's fuckall I can do without convincing a government IT department to send me logs, which,

[sempf@infosec.exchange]

@ryanc That's direct violation of 5321 isn't it?

[ryanc@infosec.exchange]

@Sempf Yeah. So? Lots of domains bounce postmaster@

[sempf@infosec.exchange]

@ryanc That's a good point.

[tychotithonus@infosec.exchange]

@Sempf @ryanc
It's been awhile since I was in the daily email game, but I assume blowback is still a non-trivial problem, such that silent discard, despite non-compliance, might sometimes be preferable to innocent bystanders receiving blowback? But deciding when to do that must be complicated ...

(Put another way: I don't think the RFC framers had "spoof millions of senders s day" in mind as something to be standardized against)

[ryanc@infosec.exchange]

@tychotithonus @Sempf rejection at smtp transaction time does not cause backscatter

[tychotithonus@infosec.exchange]

@ryanc @Sempf That works fine when there are only two SMTP servers involved, but what happens when it is multi-hop?

[ryanc@infosec.exchange]

@tychotithonus @Sempf if they can't be bothered to decide whether they're going to accept it at that time

[ryanc@infosec.exchange]

@tychotithonus @Sempf hold the connection while validating at the next hop

(this is a bit ideological)

[ryanc@infosec.exchange]

@tychotithonus @Sempf being less extreme, it's pretty safe to send a bounce if SPF and DKIM validate

[tychotithonus@infosec.exchange]

@ryanc @Sempf I mean, I get that, but in the meantime the blowback still hits the innocent non-sender. As a troubleshooter, I 100% hated silent discard, but as a spam fighter from back in the day, never doing that produced a whole bunch of busy work and harm that was impossible to work around otherwise. (Rejecting early in the connection was of course ideal!). But I've been out of this game for more than a decade ...

[tychotithonus@infosec.exchange]

@ryanc @Sempf Yeah, that's definitely an angle that wasn't as available to me back then. If past me it was working this, I would 100% be looking for a milter that did that!

[sempf@infosec.exchange]

@tychotithonus @ryanc I have learned more about SMTP in this conversation then I have in 25 years of fucking with it.

[ryanc@infosec.exchange]

@tychotithonus @Sempf the cursed thing here is that the sending side is silently discarding it

[ryanc@infosec.exchange]

@Sempf @tychotithonus do you need a hug?

[sempf@infosec.exchange]

@ryanc @tychotithonus No, just a brain.

[erik@mastodon.infrageeks.social]

@Sempf @tychotithonus @ryanc is that what happens when you hit the age of the port number? Remind me to die before I hit 80 years old...

[ryanc@infosec.exchange]

@erik @Sempf @tychotithonus I've forgotten more about HTTP than most people will ever know...

[sempf@infosec.exchange]

@ryanc @erik @tychotithonus I was gonna say, I spend most of my time at 443 so I'm probably ok there.

[drscriptt@oldbytes.space]

@ryanc @tychotithonus @Sempf well it might, but it won’t be your server sending the back scatter.

The server you refused to accept the message from us coulpable for the backscatter. Maybe it shouldn’t have accepted the message in the first place.