Re: [exim] forany() with multiply recipients

On 21 Feb 2013, at 18:42, Todd Lyons <tlyons@???>
wrote:

> On Thu, Feb 21, 2013 at 10:17 AM, Todd Lyons <tlyons@???> wrote:
>> example) recipients before the DATA phase and you issue a 2XX response
>> after the DATA phase, you MUST deliver the email for all 5 or a DSN
>> for those you didn't successfully deliver for. The Postini style
>
> Following up, sending all these DSNs is of course bad since you'll be
> sending out backscatter and it will get you into all kinds of RBL's.
> So honoring the RFCs means you have to potentially do bad things when
> you accept but don't really intend to deliver to X number of the
> recipients.


That's true, but actually we now have the tools to approach this more subtly. An SPF PASS should make it OK to send a DSN. The presumption here is that the domain owner will take care of local-part forgery.

One could argue that domains that don't publish SPF records don't care about sender address forgery, and therefore don't care about backscatter. So, perhaps it's OK to send DSNs into domains without SPF records. And perhaps it's OK when the result is NEUTRAL (no policy).

Clearly, it's NOT OK to send a DSN for a message with an SPF FAIL.

It's probably not OK to send a DSN for softfail - but DMARC records might help us there.

So, (a) there will be a few MTAs with PRDR, with a substantial market share between them, (b) a substantial proportion of email is to single recipients (including personalised marketing, for example), and (c) a substantial proportion of senders are authenticated by SPF. Therefore, it should be possible to implement per recipient filtering for most inbound email.

--
Ian Eiloart
Postmaster, University of Sussex
+44 (0) 1273 87-3148