Subject: Re: non-complain mail system at alcatel.com

From: Bob Braden <[email-masked]>
Date: Mon, 23 Jun 2003 09:07:38 -0700 (PDT)

*> From [email-masked]  Mon Jun 23 08:26:17 2003
  *> Date: Mon, 23 Jun 2003 06:26:03 -0400
  *> From: "vinton g. cerf" <[email-masked]>
  *> Subject: Re: non-complain mail system at alcatel.com
  *> X-Sender: [email-masked]
  *> To: Michael Richardson <[email-masked]>, [email-masked],
  *>    [email-masked], [email-masked], [email-masked],
  *>    [email-masked]
  *> Cc: [email-masked], [email-masked]
  *> MIME-version: 1.0
  *> X-AntiVirus: scanned by AMaViS 0.2.1
  *> 
  *> I would be interested to know whether Alcatel really believes that DNS behaves in such a way that one MUST delegate at each "dot" - as far as I know, it is NOT required to do so.

Of course it is not!!  I'll bet you will find a counter example in
the DNS RFCs.

Bob

  *> 
  *> vint
  *> 
  *> At 04:01 PM 6/22/2003 -0400, Michael Richardson wrote:
  *> >-----BEGIN PGP SIGNED MESSAGE-----
  *> >
  *> >
  *> >Alcatel.com does not have a functional email system. It believes that
  *> >all domains must have full NS-record delegations. I.e. that my domain
  *> >"sandelman.ottawa.on.ca" must be a delegation from "ottawa.on.ca",
  *> >rather than from "ca". (The .CA namespace has a single ccTLD)
  *> >
  *> >I have contacted Alcatel repeatedly by email and by phone in the
  *> >past months, and I have gotten no response to this. A major problem is that 
  *> >I think that only one of their MX's has this behaviour.
  *> >
  *> >So, I'm resorting to the only other way I have - embarassment.
  *> >
  *> >Specifically, it says:
  *> >
  *> >The original message was received at Sat, 21 Jun 2003 14:27:27 -0400 (EDT)
  *> >from IDENT:[email-masked] [192.139.46.2]
  *> >
  *> >   ----- The following addresses had permanent fatal errors -----
  *> ><[email-masked]>
  *> >    (reason: 550 sender ignored: ottawa.on.ca does not have a name server record)
  *> >
  *> >   ----- Transcript of session follows -----
  *> >... while talking to primary.alcatel.com.:
  *> >>>> MAIL From:<[email-masked]>
  *> ><<< 550 sender ignored: ottawa.on.ca does not have a name server record
  *> >554 5.0.0 Service unavailable
  *> >
  *> >-----BEGIN PGP SIGNATURE-----
  *> >Version: GnuPG v1.0.7 (GNU/Linux)
  *> >Comment: Finger me for keys
  *> >
  *> >iQCVAwUBPvYLIYqHRg3pndX9AQH+1QP/fe0rInX+kaX3QQFFlnF6qNEzDyVGsTcf
  *> >NptzvtrzSUqQC1TMXYMII25nkvk4G2p73qWDxmoTxGhax/CYhJyZwPfPpLO/AqV9
  *> >Nl8wmGE6sLMMCorgsX+O52Q5Rdni/LK/yMz0RYf/wkZnhIBTpqINww6TtANnsAZ5
  *> >RkOSQjDwrLc=
  *> >=7AxR
  *> >-----END PGP SIGNATURE-----
  *> 
  *> Vint Cerf
  *> SVP Architecture & Technology
  *> MCI
  *> 22001 Loudoun County Parkway, F2-4115
  *> Ashburn, VA 20147
  *> 703 886 1690 (v806 1690)
  *> 703 886 0047 fax
  *> [email-masked]
  *> www.mci.com/cerfsup 
  *> 
  *> 
  *> 
  *>

---

From: Simon Leinen <[email-masked]>
Date: Tue, 24 Jun 2003 10:30:48 +0200

This seems to be collateral damage of an anti-spam mechanism, and I
sent the following complaint to the Alcatel postmaster and the
bug-report address of the anti-spam software in question.
-- 
Simon.

Subject: Re: non-complain mail system at alcatel.com
From: Simon Leinen <[email-masked]>
To: Michael Richardson <[email-masked]>
Cc: [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked], [email-masked]
Date: Mon, 23 Jun 2003 11:34:57 +0200

[removed IETF mailing list from CC:; added [email-masked]]

Michael Richardson writes:
> So, I'm resorting to the only other way I have - embarassment.

> Specifically, it says:

> The original message was received at Sat, 21 Jun 2003 14:27:27 -0400 (EDT)
> from IDENT:[email-masked] [192.139.46.2]

>    ----- The following addresses had permanent fatal errors -----
> <[email-masked]>
>     (reason: 550 sender ignored: ottawa.on.ca does not have a name server record)

>    ----- Transcript of session follows -----
> ... while talking to primary.alcatel.com.:
>>>> MAIL From:<[email-masked]>
> <<< 550 sender ignored: ottawa.on.ca does not have a name server record
> 554 5.0.0 Service unavailable

Apparently, Alcatel implements "Sender Verification" on this gateway,
see:

http://sabernet.home.attbi.com/software/nospam.html

    Sender Verification:
    
        Verification of the sender's email address can be turned on by
        adding the following line to your netperm-table:
    
        smap:  nospam ns-required
    
        When a sender's email address is received, a DNS lookup is
        performed to verify that an NS record exists for the given
        domain. For example, assume that 001232.com does not exist:
    
        220 mailhost SMTP/smap Ready.
        mail from: <[email-masked]>
        550 sender ignored: 001232.com does not have a name server record
    
        This is useful if you receive lots of spam from nonexistent
        domains.

This code is obviously buggy in that it returns "false positives" in
valid setups such as Michael's.  I hope this will be fixed, and
Alcatel would be well-advised to turn off the "ns-required" option
until it is.
-- 
Simon Leinen.
SWITCH