OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
 
Subject: Re: Incessant Bounces
From: Greg A. Woods (woodsweird.com)
Date: Wed Aug 23 2000 - 11:07:40 CDT


[ On Tuesday, August 22, 2000 at 20:01:01 (+0200), Brad Knowles wrote: ]
> Subject: Re: Incessant Bounces
>
> In summary, I've had very in-depth discussions with both Eric
> Allman and Wietse, and we've all come to the same conclusions --
> there are just too many bizarre ways for resolver libraries and
> nameservers to fail in spectacularly untraceable and unreproduceable
> ways, sometimes authortiatively answering NXDOMAIN when they
> shouldn't, sometimes failing when they theoretically can't, etc....

Yes Brad, but in a growing portion, possibly even a majority, of hosts
running MTAs there is *NO* suh problem with the resolver library.

The non-issues *you* are raising again are related to *ANCIENT* bugs
long since fixed in modern code! Actually as far as I've been able to
determine from extensive research and code review, there was only ever
*one* bug in the BIND resolver which could have caused an authoritative
NXDOMAIN error to be returned to an MTA. Your fear of this problem is
apparently due only to the fact that this bug was in wide-spread use at
the time of the event you mention below. It is fairly clear from more
recent surveys that this buggy code is not in wide-spread use any more.

Yes some people still do use ancient and broken code, but not that many
people any more, and not usually in critical scenarios. However if
anyone is still using something like the original resolver from SunOS-4
then they practically deserve to be bouncing their own mail in these
cases!

So, contrary to your fear-mongering, it *is* correct to bounce mail by
default in most cases when there's an authoritative NXDOMAIN for some
name used in the SMTP envelope (i.e. HELO or MAIL FROM:).

> The one and *ONLY* safe way you can handle this situation is to
> return a temporary failure in all cases where you cannot positively
> confirm that the domain does actually exist.

Returning a temporary error is simply an invitation to trouble and even
worse confusion because it means the end user is left out of the loop
and knows not why his mail was apparently ignored! Most users won't
even be able to see that their mail is still sitting in their local
spool, and most MTAs keep such mail in hiding for several days!

You're also apparently still confusing this with some kind of unsafe
operation. The fact is that bouncing a message is "safe"! No e-mail is
ever lost! The sender might be temporarily confused by the bounce but
the very fact that the bounce happened can be an extremely valuable
diagnostic tool that will help the responsible parties ensure that such
bounces do not happen in the future (should they be so inclined to do so)!

> Now, that said, postfix *does* give you the option of returning a
> permanent 5xx series error code in cases where it gets an NXDOMAIN
> from the resolver libraries. If you really, really want that badly
> to blow your foot off with that anti-matter bomb, then postfix does
> give you the necessary tools to do that.

It is not anywhere near as big an issue as you continually make it out
to be....

> I've been in situations where I saw hundreds of thousands of
> e-mail messages bounce in the space of a relatively few minutes,
> because the nameservers on our side were screwed up, and there was
> simply no good justification for what happened as a result.

You're talking about history here, not current events.....

Please don't make mountains out of mole hills!

-- 
							Greg A. Woods

+1 416 218-0098 VE3TCP <gwoodsacm.org> <robohack!woods> Planix, Inc. <woodsplanix.com>; Secrets of the Weird <woodsweird.com>