Subject: Do you really not care whether people accept your mail?

From: "John R Levine" <[email-masked]>
Date: 13 Mar 2017 23:51:06 +0100

On Mon, 13 Mar 2017, Carsten Bormann wrote:
> The most likely outcome is that local admins will “upgrade" our mail 
> system by turning off IPv6.  (We have had IPv6 deployed for some 18 
> years now.)

On Mon, 13 Mar 2017, Philip Homburg wrote:
> Getting mail delivered to gmail over IPv6 works most of the time without
> ever setting up SPF or DKIM. Gmail does seem to be the single most
> unreliable mail server that I know of, mostly due to their attempts
> to be more strict on IPv6.

As I hope everyone knows, receiving mail requires orders of magnitude more 
work than sending it.  Even 20 years ago before spam was an issue, 
recipients had to receive it, route it, store it somewhere, filter it with 
sieve or procmail, and provide POP or IMAP for the recipient to collect 
it.  These days, with 90% of mail being spam or worse, there's another 
magnitude of work in trying to separate the real mail from the flood of 
junk.  Or try this thought experiment: how hard would it be to send a 
million messages a day from your laptop (easy), and how hard would be be 
to receive and deliver a million messages a day on that laptop 
(impossible.)

The point of authentication schemes like SPF and DKIM is to make it easier 
for recipients to tell that your mail is from you, so they can treat it 
differently from the spam.  Everywhere else, the response is OK, I would 
prefer that people get the mail I send them, I will set up authentication 
because it is not hard (SPF takes about 5 minutes), and it helps the 
people who are handling my mail with the mail system they are paying for.

I can also assure you from many conversations with large mail providers 
that you will increasingly find that recipients will conclude that if you 
can't be bothered to authenticate your mail, they can't be bothered to 
deliver it.  It's their mail system, they get to do that.

In the IETF, for some reason, people take a perverse pride in offering no 
help whatsoever to mail recipients, even when that help costs them 
nothing, and then snark and whine when the recipients have trouble dealing 
with the unauthenticated mail.  I don't understand why, but I really wish 
people would stop.  Nobody is impressed that your mail system does exactly 
what it did 20 years ago, and it gives outsiders the impression that the 
IETF is a bunch of out of touch sociopaths.

R's,
Johh

---

From: Jared Mauch <[email-masked]>
Date: Mon, 13 Mar 2017 19:30:54 -0400

> On Mar 13, 2017, at 6:51 PM, John R Levine <[email-masked]> wrote:
> 
> Nobody is impressed that your mail system does exactly what it did 20 years ago, and it gives outsiders the impression that the IETF is a bunch of out of touch sociopaths.

So much this above. You either conform to the norms or are the outlier. Grousing on a mailing list when most of the world is using something else will get you results similar to /dev/null

- jared

---

From: Phillip Hallam-Baker <[email-masked]>
Date: Mon, 13 Mar 2017 22:41:46 -0400

​Perhaps we should just recognize the fact that SMTP does not really
support mailing lists, it never has and never will. All the kludges and
duct tape in the world won't fix what is broken here.

I read my IETF mail through gmail because, well its easiest to do that. And
I have roughly 10GB of mailing list traffic. Most of which is probably
copied 50-100 times or more.

A much more efficient approach would be to use SMTP to submit the mail and
some other protocol (POP3, RSS, IMAP, something new) to retrieve it.

Protocols do wear out and at some point it is easier to start from scratch

Build in end to end encryption while we are at it.
​

---

From: Viktor Dukhovni <[email-masked]>
Date: Mon, 13 Mar 2017 22:56:11 -0400

> On Mar 13, 2017, at 10:41 PM, Phillip Hallam-Baker <[email-masked]> wrote:
> 
> Perhaps we should just recognize the fact that SMTP does not really support mailing
> lists, it never has and never will.

This is absurd, perhaps we can recognize that Yahoo does not support mailing
lists, ...  SMTP works with lists just fine.

In any case, the issue at hand is not even about lists, Gmail imposes more
strict constraints on IPv6 senders than IPv4 senders.  For now I prefer to
send over IPv4 rather than reduce the deliverability of my mail when some
fragile "authentication" mechanism fails.  Thus no SPF, or DMARC for my
domain at present.  This trade-off is subject to periodic reassessment,
for now that's what works best for me.  Some day I may enable outbound
DKIM signing, and perhaps (much) later as a last resort SPF.  So far,
neither have been needed.

-- 
	Viktor.

---

From: Christopher Morrow <[email-masked]>
Date: Tue, 14 Mar 2017 00:08:29 -0400

> duct tape in the world won't fix what is broken here.
i hear a vote for nntp..

---

From: "John R Levine" <[email-masked]>
Date: 14 Mar 2017 08:43:15 +0100

On Mon, 13 Mar 2017, Phillip Hallam-Baker wrote:
> support mailing lists, ...

These complaints had nothing to do with lists or DMARC.  They were about 
sending ordinary unauthenticated mail over IPv6.  If they wanted to fix 
that problem, they could do so in 10 minutes by publishing an SPF record, 
with no other changes to the way their mail works.

R's,
John

---

From: Tim Chown <[email-masked]>
Date: Tue, 14 Mar 2017 08:53:56 +0000

> On 14 Mar 2017, at 07:43, John R Levine <[email-masked]> wrote:
> 
> These complaints had nothing to do with lists or DMARC.  They were about sending ordinary unauthenticated mail over IPv6.  If they wanted to fix that problem, they could do so in 10 minutes by publishing an SPF record, with no other changes to the way their mail works.

I must say, my chosen hosting provider, who support IPv6 very well, make publishing an SPF record very easy. It’s just a click on the control panel. 

I do think though that we could probably make it clearer somewhere ‘official’ what the issues are for people signing up to our lists, e.g. perhaps at https://www.ietf.org/list/ <https://www.ietf.org/list/>.  I had a quick look and couldn’t see anything obvious there.

Tim

---

From: "John R Levine" <[email-masked]>
Date: 14 Mar 2017 10:43:05 +0100

> I do think though that we could probably make it clearer somewhere 
> ‘official’ what the issues are for people signing up to our lists, e.g. 
> perhaps at https://www.ietf.org/list/ <https://www.ietf.org/list/>.  I 
> had a quick look and couldn’t see anything obvious there.

Once again, these complaints had nothing to do with our lists or anyone 
else's.  Carsten was complaining about sending mail to NIST, Philip about 
sending mail to Gmail.

R's,
John

---

From: Tim Chown <[email-masked]>
Date: Tue, 14 Mar 2017 09:45:50 +0000

> On 14 Mar 2017, at 09:43, John R Levine <[email-masked]> wrote:
> 
> Once again, these complaints had nothing to do with our lists or anyone else's.  Carsten was complaining about sending mail to NIST, Philip about sending mail to Gmail.

But a bit of awareness raising can’t hurt, can it?  And if we had the issue documented on an IETF page, it’s then easy to point people to that link rather than rehash the explanations.

Tim

---

From: Philip Homburg <[email-masked]>
Date: Tue, 14 Mar 2017 11:38:48 +0100

>> The most likely outcome is that local admins will ?upgrade" our mail 

It is now more than 2 decades that people keep proposing FUSSP (Final
Ultimate Solution to the Spam Problem) after FUSSP.

"There is spam problem, we need to do something"
"What you propose doesn't work"
"There is spam problem, we need to do something, this is something"

Is there any point arguing against a FUSSP? By and large there isn't. 
Until spammers start exploiting the FUSSP at a large scale, there is always
a very creative argument why spammers cannot deal with this particular FUSSP.

Some FUSSPs remain small enough that spammers don't bother. So they
seem effective. Typically in those cases there are enough negative side effects
to keep them small.

>people who are handling my mail with the mail system they are paying for.

So, we have a succession of SPF, DKIM, and now DMARC that are supposed to
protect against phishing or other identity issues. Fine, I don't have a
phishing problem, so I can ignore it.

Except of course, that it doesn't take long or it becomes a FUSSP. Look
there is no spam with [insert technology du jour]. It works.

As many people have found out, if you allow a FUSSP to bypass traditional
spam filters, then spammers quickly find out. So these things just
pile up. Or, more common, just get ignored.

>deliver it.  It's their mail system, they get to do that.

So for my mail system I look at what is actually common enough that I need
to consider it.

Reverse DNS is a rather silly FUSSP, but common enough that is is required.
And by and large I like reverse DNS.

In my experience, essentially no mail gets lost if you leave out SPF, DKIM,
DMARC. The only exception is gmail that occasionally rejects e-mail. 

In the context of IPv6 we now have an additional problem. Sites that have
filters that are more strict for IPv6 than for IPv4. The obvious very 
quick workaround for many mail admins is to avoid delivering mail over IPv6.
Of course, that just increases the SPAM/HAM ratio, justifying more draconian
measures. Which in the end will just kill IPv6 as a transport for e-mail.

---

From: Brandon Long <[email-masked]>
Date: Tue, 14 Mar 2017 16:54:33 -0700

> DMARC. The only exception is gmail that occasionally rejects e-mail.

"no mail gets lost" != "gmail occasionally rejects my mail"

> measures. Which in the end will just kill IPv6 as a transport for e-mail.

Do you imagine that you may be making different choices than others?

There are plenty of senders, in fact the vast majority by volume, who are
perfectly fine with authenticating their mail.  And many of them send over
IPv6.  This may be a speed bump, but it is not the death of IPv6 for email
transport.

There is no FUSSP, but there are many things which help make the problem
tractable.

Brandon

---

From: Philip Homburg <[email-masked]>
Date: Wed, 15 Mar 2017 12:00:20 +0100

>"no mail gets lost" != "gmail occasionally rejects my mail"

What I meant to write is that when I take all e-mail targets that I send e-mail
to, leaving out gmail, then sending mail without SPF, DKIM, DMARC works just
fine.

Gmail is an exception because it seems that gmail is broken if you deliver
mail without SPF, etc. over IPv6 to gmail. That's unique to gmail.

So if your outgoing mail doesn't have SPF, etc. and you do have IPv6, then
you have to think about what to do with gmail.

In any case, that's my experience.

In some sense it is amazing how reliable e-mail is. E-mail seems to be
reliable enough that gmail rejecting the occasional e-mail immediately
makes it the most unreliable e-mail provider (for my e-mail). 
That's also an amazing success story.

>Do you imagine that you may be making different choices than others?

Imagine that some will be making different chocies than me, yes.

>IPv6.  This may be a speed bump, but it is not the death of IPv6 for email

It is likely that a few big providers together will make up the vast majority
of e-mail volume.

However, gmail (or in fact any I send mail to) has not made SPF, etc.
mandatory. So if gmail would make DMARC mandatory for IPv4, that would
signal something.

Maybe gmail can publish some graphs, contrasting the percentage of 
mail that arrives over IPv6 to IPv6 adoption for other google services?

---

From: Nico Williams <[email-masked]>
Date: Wed, 15 Mar 2017 10:35:03 -0500

> mail without SPF, etc. over IPv6 to gmail. That's unique to gmail.

The problem is twofold: a) gmail has a huge number of mailboxes, so if
you can't deliver to them without SPF/DKIM/DMARC, then your mail truly
is broken, b) they could be setting the rule, so that even if you don't
mind (a), you soon will feel the pain.

> you have to think about what to do with gmail.

As a user, when I send email, I don't want to think about this sort of
thing.  An admin has to think about this sort of thing, and it's looking
a lot like email is nowhere near the relatively easy service to run that
it was in the 90s.

> That's also an amazing success story.

Well, I adore email, and email lists.  Screw the haters.  But it's true
that we have a problem, and if we don't manage it then email will be
obsolete and I'll be sad.

> Imagine that some will be making different chocies than me, yes.

Balkanizing email doesn't sound very good to me.

Nico
--

---

From: Rich Kulawiec <[email-masked]>
Date: Wed, 15 Mar 2017 11:57:30 -0400

On Mon, Mar 13, 2017 at 10:41:46PM -0400, Phillip Hallam-Baker wrote:
> ???Perhaps we should just recognize the fact that SMTP does not really

I disgree.  I have about 260G of mailing list, newsgroup, and RSS traffic
(both of which latter two can be coerced into mbox format, making it
possible to use the same tools on them) and I have no problem managing
it, searching it, using it.  I think it's just a matter of selecting
the right approach, including the right tools.

Mailing lists are clearly the best mechanism for group collaboration
that we have (I'll enumerate my reasons for that if necessary) and it
would be a major strategic error to move away from because they're not
handled well at the moment by some hastily-deployed technologies that
failed to fully take them into account.

---rsk

---

From: Brandon Long <[email-masked]>
Date: Wed, 15 Mar 2017 17:54:02 -0700

> a lot like email is nowhere near the relatively easy service to run that

Do you run spam filters on your mail server today? Do you run an open relay?
Does your mail client support html email?  How about MIME?

Yes, running a mail server today is not like it was 25 years ago.

> Balkanizing email doesn't sound very good to me.

Is it balkanizing email to require five minutes to set up an SPF record?
Not setting it up is a choice to be on the outside.

Imagine if instead they were refusing to add an IPv6 address to their mail
server, so they wouldn't ever be able to send to an IPv6 only MX.  Who is
making the choice to balkanize then?

Brandon