Catch up on stories from the past week (and beyond) at the Slashdot story archive

 


Forgot your password?
Close
typodupeerror
×
Spam The Internet

SpamHaus Behind .mail Top-Level Domain 304

Posted by CowboyNeal from the better-mail-for-a-better-tomorrow dept.
securitas writes "The SpamHaus Project is the group pushing ICANN to create a new trusted-sender system and the .mail top-level domain. SpamHaus proposes that registrants under the .mail TLD would pay at least $2000 per year to and 'agree to abide by certain anti-spam mailing practices.' The interesting twist is that companies that comply with the US CAN-SPAM act - which SpamHaus opposed due to the legalization of bulk unsolicited commercial e-mail - would not be eligibile to register a .mail address. The .mail TLD proposal was recently discussed on Slashdot."
This discussion has been archived. No new comments can be posted.

SpamHaus Behind .mail Top-Level Domain More

SpamHaus Behind .mail Top-Level Domain

Comments Filter:

  • Maybe a Good Thing? (Score:5, Insightful)

    by Liselle ( 684663 ) * <slashdot&liselle,net> on Thursday March 25, 2004 @06:18PM (#8673960) Journal
    I never get to be the one who says "but wait, this is a GOOD thing", so I'll toss it out there now, flamebait be darned.

    The interesting twist is that companies that comply with the US CAN-SPAM act - which SpamHaus opposed due to the legalization of bulk unsolicited commercial e-mail - would not be eligibile to register a .mail address.
    This could probably be worded a little more clearly. Complying with the CAN-SPAM act is as easy as not doing anything at all. I think what the submitter means, correct me if I'm wrong, is the "one-shot" bulk mail that a company is allowed to send you under CAN-SPAM. Obviously, SpamHaus considers this spam, still, even though it's technically legal (I would tend to agree).

    This new TLD proposal, according to their FAQ [spamhaus.org], is not aimed at stopping spam, or replacing the email infrastructure from the ground up. It's more towards legitimizing non-spam email. It may not be technically possible (not my area of expertise, I remember some nay-sayers in the last article discussion who at least sounded like they knew what they were talking about), but I still think their hearts are in the right place. Am I wrong?

    I'm looking forward to the whitepaper they've promised on it.

    • Re:Maybe a Good Thing? (Score:4, Insightful)

      by Anonymous Coward on Thursday March 25, 2004 @06:34PM (#8674113)
      Not good. We can't trust to filter our mail based on some fixed definition of "spam". I want to choose *my* definition, or choose whose definition I want to use (people can publish black lists and I can choose the black list I want to use).

      • Since .mail wouldn't define spam, only "not spam", isn't it a fancy/expensive whitelist? Like anything else, you can choose to filter email from .mail however you like.

        The only exception that comes to mind if your ISP took the decision out of your hands. However, they would ONLY do this if it became massively widespread (otherwise they'd be throwing out 99% of valid email). I'd like to think that if .mail ever reaches the kind of penetration that would make ISPs take notice, we wouldn't need to worry

        • Re:Maybe a Good Thing? (Score:4, Insightful)

          by SillyNickName4me ( 760022 ) <dotslash@bartsplace.net> on Thursday March 25, 2004 @07:06PM (#8674377) Homepage
          > isn't it a fancy/expensive whitelist?

          Yes it is, and its yet another attempt to get a service out of the control of the end user.

          • Not to mention this would have a horrible effect on any of us running our own self-serve linux boxen. Redhat might have to take sendmail off their list of applications installed by default if all email gets blocked that doesn't have a .mail domain associated with it.

            I doubt many home users are going to cough up $2-3k!

            Has anyone else noticed how hard it is to get smtp service these days? Go ahead, register a domain & pay for email service. If they offer smtp service at all they won't give it to you u

        • How could the ISP take the decision out of my hands? The way I see it, .mail is just another TLD. It means no more to me than a .cn or a .tv does. I would never ever set an email filter to automatically accept any emails coming from a particular domain. I get plenty of spam that purports to come from .edu, and as a matter of fruitless civil disopedience, I block all .gov addresses.

          When it comes down to it, isn't it still about me deciding whether I want to read an incoming email or filter it out?

          How w
    • Why don't ISPs force authentication on their SMTP servers to cut down on spam? wouldn't this make sense? I mean, I work for an ISP, and they have a banned IP list from within their domains. When they get a complaint, these userser a put on the list and can't send mail anymore using our servers (or any other SMTP servers on port 25)... the problem with that practice, is that they can only ban people on static IPs, and most of their customers are on DHCP and dynamic IPs. Seems to me, if they force authentica

      • Re:Maybe a Good Thing? (Score:3, Interesting)

        by Zak3056 ( 69287 )
        work for an ISP, and they have a banned IP list from within their domains. When they get a complaint, these userser a put on the list and can't send mail anymore using our servers (or any other SMTP servers on port 25)... the problem with that practice, is that they can only ban people on static IPs, and most of their customers are on DHCP and dynamic IPs.

        I wonder why they don't take this to the next level and use the information in PPP or DHCP logs to blacklist the ones with dynamic addresses?

    • Re:Maybe a Good Thing? (Score:3, Insightful)

      by Anonymous Coward
      THis most certainly is NOT a good thing.

      I own my own mailserver. I built it myself. I run it myself. I'm the only one with an account. It is for my large site that has about 100,000 registered accounts. Not one single piece of spam has ever been sent from my servers nor would it. It is used merely to send notices and account registration confirmations and the like to users who have accounts and rely on these notices and emails as part of the functionality of our site.

      It is a non-commercial site. I make ze

  • Correction (Score:5, Insightful)

    by rgmoore ( 133276 ) * <glandauer@charter.net> on Thursday March 25, 2004 @06:19PM (#8673974) Homepage
    .' The interesting twist is that companies that comply with the US CAN-SPAM act - which SpamHaus opposed due to the legalization of bulk unsolicited commercial e-mail - would not be eligibile to register a .mail address.

    That's not quite correct. The SpamHaus rules wouldn't ban anyone who obeyed the CAN-SPAM act. Presumably most ordinary companies obey CAN-SPAM by refusing to do anything that vaguely resembles spamming, and they'd be just fine under the SpamHaus rules. What SpamHaus wants to do is to use a stricter definition of what constitutes spam, so that some senders who meet the terms of CAN-SPAM still wouldn't qualify.

    • That's not quite correct. The SpamHaus rules wouldn't ban anyone who obeyed the CAN-SPAM act

      I belive you are mistaken. As I understand CAN-SPAM, you can spam all you want, so long as you have a postal address in the mail, a working opt-out mechanism, and dont forge anything. Note: complying with CAN-SPAM just means your email is legal, not that it isn't spam.

      • Re:Correction (Score:2, Informative)

        by rgmoore ( 133276 ) *

        I think that you're misreading what I wrote. The point is that there are two ways of obeying the CAN-SPAM act:

        1. Putting a legitimate address in the mail, having and opt-out, etc.
        2. Refusing to spam.

        My point is that the original article seems to say that neither group 1 (spammers who follow the rules) nor group 2 (non-spammers) would be allowed to register under .mail. This would obviously be stupid, and isn't what SpamHaus is saying.

  • Goodby home mail server (Score:5, Interesting)

    by HaeMaker ( 221642 ) on Thursday March 25, 2004 @06:20PM (#8673988) Homepage
    This is bad, as I host my own domain and send mail from it. I don't want to have to pay someone to host my mail server, and you know that plenty of ISPs will block mail that doesn't come from a .mail domain.

    I certainly can't pay $2000 a year.
    • Goodbye free email as well. I'm sure there will be various administrative costs associated with this new system (to ensure that your server can never be used for spam) that will be a lot more than 2 grand a year. It will be a lot harder for Hotmail and Yahoo to justify having free email access.

      • Re:Goodby home mail server (Score:5, Interesting)

        by mdfst13 ( 664665 ) on Thursday March 25, 2004 @06:50PM (#8674247)
        I used to administer a mail server that had 40,000 users give or take (IMAP only, not web). The hardware cost about $200,000. I wouldn't be surprised to find out that the support contract was $2000 a year.

        Yahoo/Hotmail both have far more users than that. $2000 is not going to be a big deal for them (for example, with 2 million users, it would be a tenth of a penny per person). I'm sure that they are already spending far more than that on hardware, software, and administration.

    • Re:Goodby home mail server (Score:5, Insightful)

      by Anonymous Coward on Thursday March 25, 2004 @06:28PM (#8674065)
      I certainly can't pay $2000 a year.

      Nor can a lot of people, which is why this propsal will never work.
      • Interestingly spammers CAN pay that, so I don't see how this is a good idea!!
        • Spammers can't afford to pay that every time they have to register a new domain because the old one got taken down due to violation of the spam rules of the hoster. And you can bet they would be taken down, if SpamHaus has anything to do with writing the rules.
          • Sure they can. I get spammed by plenty of people who can afford that. ISP's, banks, Amazon, partners of some company I bought a product through online, porn sites etc... All of which HAVE money. They can afford to send snail mail, they can afford 2k to spam me.

            No matter what way you cut it this problem wont be solved by political bullshit, or bussiness bullshit. Its a technical issue, it will be solved by technical means. Some hacker needs to sit down and spend a few months writing an open standard for

      • Re:Goodby home mail server (Score:4, Insightful)

        by firewood ( 41230 ) on Friday March 26, 2004 @03:07AM (#8677565)
        > This is bad, as I host my own domain and send mail from it. I don't want to have to pay someone to host my mail server, and you know that plenty of ISPs will block mail that doesn't come from a .mail domain.


        Nor can a lot of people, which is why this propsal will never work.

        The current email system already doesn't work. There's no way people who get 1000's of spam emails per day will ever find email from your domain in their mail filter logs. So this plan doesn't have to work. It just has to be less broken then the status quo.

    • Re:Goodby home mail server (Score:5, Insightful)

      by technomancerX ( 86975 ) on Thursday March 25, 2004 @06:29PM (#8674067) Homepage
      Heh one domain? You're lucky. I host 5 and handle email for all of them. I REALLY can't afford $10,000 just to provide my family with email addresses. This entire proposal is insane.

      • Re:Goodby home mail server (Score:4, Insightful)

        by dioxide ( 149116 ) on Thursday March 25, 2004 @06:44PM (#8674186)
        Only the smtp server needs to have a .mail domain, right? You can host an indefinite ammount of domains for email on one server, I don't see any reason why you would need a .mail domain for every email domain.
      • Heh one domain? You're lucky. I host 5 and handle email for all of them.

        I'll see your 5 and raise you another 7. A few of those are actual paying customers; the rest are a personal domain, domains I and some friends use to do business with, and a few domains I host as freebies for organisations I like. This scheme would make the cut of my gross income that I give to Uncle Sam (and his state and local nephews) seem rather small in comparison... and at least for that I get free police service, road cons

    • Re:Goodby home mail server (Score:4, Insightful)

      by gl4ss ( 559668 ) on Thursday March 25, 2004 @06:29PM (#8674069) Homepage Journal
      which also pretty much means it won't go through.

      it would also rely on spammers actually playing by the rules.

    • Re:Goodby home mail server (Score:4, Informative)

      by RetroGeek ( 206522 ) on Thursday March 25, 2004 @06:30PM (#8674084) Homepage
      But there is nothing stopping an ISP from allowing mail from your domain, as long as there is a certificate attached to it.

      So then you need to buy a certificate. And there will be competitino for these certifiicates which should drive the price down to a reasonable level.

      • Re:Goodby home mail server (Score:4, Informative)

        by aderusha ( 32235 ) on Thursday March 25, 2004 @06:41PM (#8674163) Homepage
        just like competition has driven down the price of ssl certificates? that's outrageous.

        like the original poster, i run about 10 domains on a mail server at home for myself and some friends. at $250 for a 2 year cert (bargain basement prices), that's going to cost me $1250 a year, which i think is unreasonable for the "little guy" who isn't running a company.

        keep in mind that there are plenty of people happily using the internet that have no commercial intent whatsoever. i know it's very un-american of me, but none of my websites and domains are intended to make money.

        competition is only going to drive down prices if there is true competition, which currently isn't the case with certificates. basically, microsoft has de facto control over who can issue certificates as they control which trusted root certificates are going to ship with their browsers. until this situation has changed, i'll take my chances with either un-secured connections or educating my users on how to install a root certificate into their browser before i pay into the verisign cartel.

        • Re:Goodby home mail server (Score:4, Insightful)

          by justMichael ( 606509 ) on Thursday March 25, 2004 @06:53PM (#8674271) Homepage
          You should really shop around...

          InstantSSL [instantssl.com] sells 2 year certs for $89.

          And they are trusted by the same 99.3% (who came up with that number) of browsers as Verisign.
          • I've used InstantSSL. It works, no question about that. However, I was able to get it without really doing anything more than providing a credit card number. I hate Verisign with a passion, but I have to admit that their SSL certs mean a hell of a lot more to the end-user. An applicant has to jump through a lot of hoops to get a cert with them. I've had to fax them business verification paperwork and other ID. They then take the time to verify that this paperwork is kosher by cross-referencing it with state
            • I hate Verisign with a passion, but I have to admit that their SSL certs mean a hell of a lot more to the end-user.

              First, when does the end user ever have any idea of what company your cert is from? That information is never even presented to the user unless the CA is unknown. The end user knows when the little padlock is closed in his browser status bar and that's it.

              Second, even were the end user to know which CA is being used, how would they have any idea of the relative difficulty of getting a Veri

    • Goodbye semi-professional mail server (Score:4, Insightful)

      by fearlezz ( 594718 ) on Thursday March 25, 2004 @06:40PM (#8674157)
      I have a server of my own, hosting my personal site, some sites for family and for a few charity organisations. Total income for hosting: $0. If I would need to buy another domain like this, just to be able to send mail, my costs will triple.

      I cannot afford this. Meaning I will have to close all sites.

      .mail is NOT an option if it costs more than $5!!!

      Personally, I think SPF is the best solution so far. It may not stop spam, but at least it stops forging headers, like the headers of 99,9% of spam in my inbox are.
    • I don't think you can have it both ways...

      Either anyone and everyone can run their own mail server (home users as well as spammers), or only select people are allowed to run a mail server (selected by buying a certficate, or a domain, or whatever).

      As long as people are allowed to run their own mail servers, some of those will be open due to ignorance, and some of those will be used by spammers. Just a thought.

  • Just cut to the chase (Score:5, Funny)

    by siliconbunny ( 632740 ) on Thursday March 25, 2004 @06:21PM (#8673990)
    Set up a .spam level, and we can block everything from that if we want.
    • Actually, I know you were joking, but how about passing a law that all UCE would HAVE to come from a .spam domain. Nice and easy to block that way. Toss that into the CANSPAM law.

  • This is dumb (Score:4, Insightful)

    by Michael Hunt ( 585391 ) on Thursday March 25, 2004 @06:21PM (#8673992) Homepage
    This is a retarded idea from the get-go.

    We already have a perfectly good, workable proposal for sender validation. It's called SPF. It's free. It will work, like this proposal, when people adopt it.

    Seriously, $2k to prove that you're not a spammer, by one organisation's definition of the phrase? That sounds like profiteering to me, much along the lines of Ironport's dodgy Bonded Sender (tm) program.

    No thanks.
    • That sounds like profiteering to me

      Really? Surely you would receive $2000 worth of services in exchange for your hard earned money!

      1. Spam everyone like crazy.
      2. Extort^H^H^H^H^H^HSell a $2000/year TLD.
      3. Profit!

      Doesn't the mob do something like this?

    • Re:This is dumb (Score:3, Interesting)

      by rgmoore ( 133276 ) *

      But this proposal is quite different from SPF. Under SPF, anyone with a domain is allowed to define which computers are valid mail senders for that domain, but there's no further restriction. That would prevent spammers (and email worms) from falsifying their sender address, but it doesn't directly confront the issue of spam. A spammer with his own domain, presumably hosted by a spam-friendly service provider, can still define his own computers as being permitted senders for that domain and send out spam

      • There's another issue, of course, which is that .mail cannot work without widespread adoption of SPF (or another forgery-prevention mechanism).
    • SPF doesn't say you're not a spammer - it just prevents spammers from pretending to be you, at least without doing extra work. That makes it harder for them to impersonate you if you're widely whitelisted (like Dave Farber or Declan) or joe-job you if they're mad at you. Dot-Mail will need to use something like SPF or Reverse-DNS lookups to discourage impersonation, but Spam-R-Us.com can use SPF to tell you that a message really came from Spam-R-Us.com, while they can't be Spam-R-Us.com.mail for very long
  • Because the cost of entry is high, and perhaps policed, it basically becomes a way of saying, "It's from a .mail domain, so it must NOT be spam."

    Whatever. Just like many whitelist methods, it has the standard flaws.

    But I guess it couldn't hurt! Companies with the big bucks or with donors (I'm thinking Samba mailing lists, etc), could afford it.

    The rest of us slobs would continue to crawl around in the .com, .net, .org, and .dust domains.

    As an aside, could you have the same problem with this domain as with AOL's spam filtering, i.e., false reports? What are the punishments for violating the rules of the .mail domain? Death?
    • What are the punishments for violating the rules of the .mail domain?

      Presumably loss of domain...

    • From the article:

      SpamHaus probably won't have many hurdles from a technical stability standpoint. The organisation is tapping VeriSign, which has more experience operating TLDs than any other company, to provide the back-end infrastructure.

      Be thankful; $2000 is VeriSign cutting-their-own-throats :-)

    • Why cannot we just all agree to have reverse MX records and everybody can make their own whitelist and no need to pay $2000 or even $250 to anyone.
      • Can someone please mod up the parent. This is one of a handful of technological solutions that will virtually eliminate spam, but require community acceptance.

        For christs sake people, the solutions exist. It's time to stop talking as if this is a hard problem and start acting like we know what we're doing.
        • Spam that complies with CANSPAM would not be affected by SPF, actualy, as there are no forged headers. But it would be obvious who sent it and it would allow much better prevention.

          One change I'd make, though, is rather then using IP address, use digital signatures.
    • They don't realize that while for a normal person, $2000 is a lot of money, but for a company, $2000 is pocket change not worth picking up if you drop it. The entry price isn't giong to stop ANY spammers.

      It also makes it much easier for spammers. Spammers know how to forge IP's. So now they know that if they make it seem like it's from .mail, people will automatically accept it, and they won't have to worry about spam filters.

      You can't beat spammers at the network. They will ALWAYS find a way around i

  • $2000 - one time, or per year? (Score:4, Interesting)

    by That's Unpossible! ( 722232 ) * on Thursday March 25, 2004 @06:21PM (#8673994)
    The register article says $2000+ per year, the spamhaus faq just says they will cost $2000+. So is it a one-time fee (sounds good), or an annual fee?

    I am guessing it is a one-time fee, and the renewal will be less. Spamhaus states the up front cost is high as the first roadblock for spammers -- why pay $2000 for the domain when you are going to get shutdown almost immediately after using it to send spam? It also is going to cost them more than normal to run this sTLD. So a large one-time fee makes sense.

  • not great! (Score:5, Insightful)

    by Roger Keith Barrett ( 712843 ) on Thursday March 25, 2004 @06:21PM (#8673997)
    This is just great... create a two-tiered system with "trusted" and "untrusted" e-mail servers. Guess who will own the "trusted" servers... corporations who can afford to pay the fee!

    I would like the ability to run my own servers and web sites as an individual, please. We don't need ANY system of top level domains that favor corporations over non-corporations. Find another way around the problem, please.

    • Re:not great! (Score:2, Insightful)

      by SupaZeph ( 758438 )
      This is just great... create a two-tiered system with "trusted" and "untrusted" e-mail servers. Guess who will own the "trusted" servers... corporations who can afford to pay the fee!

      Because we all know that big corporations would never, ever, ever let spammers use their network, misconfigure a mail server, get hacked, etc.
      *cough* AOL spam *cough*
    • It would be better if they just charged the regular 15 bucks a year or whatever. Then they could just make rules that if you used the domain to send spam you lose the domain. This is what they were already going to do when charging $2000. The price tag isn't going to stop any spammers but it will stop some legit people from getting a domain.

    • Re:not great! (Score:2, Insightful)

      by cipher chort ( 721069 )
      I'm in agreement. There is a frightening trend on the Internet to "centralize" and "take power from the Edge(TM)". What that really means is "commercialize" and "make non-free/non-open". It's going counter to the very basis of the Internet, which is free sharing of information.

      It's happening with ISPs that do draconian port filtering to prevent their paying users from being able to host their own content, to VeriSign attempting to own typos, to Microsoft wanting to decide how e-mail "postage" is used, a
    • $2000/yr is not a lot of money and believe it or not, most companies (hosting, colo, and webservers) generally provide mail servers for you to use. Just because some techie wants to run their own qmail-patched-hacked-whatever (I love qmail, btw) doesn't mean they should. If they mess up, it could mess up the system. $2000/yr comes out to $166/mo. I pay more for satellite and DSL than that.

  • $2000 is the upper limit (Score:5, Informative)

    by alanw ( 1822 ) * <alan@wylie.me.uk> on Thursday March 25, 2004 @06:22PM (#8673998) Homepage
    In this posting [google.com] to news:news.admin.net-abuse.email Steve Linford of Spamhaus says:
    the $2000 quoted in the application is the highest estimate, given at the deadline because ICANN rules don't allow you to increase a price later
    and in this posting [google.com] he says
    (we'd prefer it in the region of $250)

    • Re:$2000 is the upper limit (Score:3, Informative)

      by alanw ( 1822 ) *
      Oops - those links are both the same - the second one should have been to this posting [google.com]

    • Ok, then they need to update their FAQ [spamhaus.org], question 9 "What does a domain cost and why?":

      The use of each domain will cost over US$2000. The price may vary depending on the registrar one uses.

      This high cost will insure that most spammers will not bother and attempt to sign up for one, and if they do, it will be a high cost for what will be a very short time period of spamming.

      The cost also pays for the much greater than normal vetting procedures places requesting this domain will go though before one is g

  • I run my own correctly configured personal mail server, and paying $2000 a year for a .mail address is a ripoff for the three or four email addresses I've made myself (a firstname@lastname.net address and other various spam oriented addresses). I first thought it would be a good idea, but the $2000 makes it unreasonable for all but medium to large businesses. I definately dont see small companies of 10 people paying that much for a mail domain.
  • They want to charge me $2,000 for this? Come on, if I have a personal little domain for myself and the only people I ever email are my friends and cow-orkers, I have to pay $2,000 to be sure I'll get past spam filters? Ridiculous.
    • And who exactly gets this $2000? And why do they deserve the $2000? I'm not paying a $2000 registration fee just to have a domain name, there had better be more to the deal.
    • I haven't RTA, but how does this exactly deal with the spam that comes from zombied computers and/or spoofed email addresses? While I wouldn't waste $2K to send spam, a spammer (who is paying for almost nothing else that he's using to send the crap anyway) wouldn't care about that money because it's not his. Thus he has no incentive (in fact, he has a larger incentive) to commit illegal acts - because spam that is whitelisted is likely to be more effective that spam that isn't.

      At best, this seems like a

  • Take your fee and shove it. (Score:3, Insightful)

    by ---s3V3n--- ( 398159 ) on Thursday March 25, 2004 @06:24PM (#8674019)
    Registration fees to send mail via .mail?! No way, I know lots of small shots that wouldn't be able to afford that.

    Beyond that $2000 is chump change for spammers. It hurts no one but the honest guy, which is what government lately seems to be for, so perhaps it'll get pushed as a law. *sigh*

  • What we really need... (Score:4, Funny)

    by ackthpt ( 218170 ) * on Thursday March 25, 2004 @06:24PM (#8674022) Homepage Journal
    What we really need is a .spam tld. All mass emailers not using .spam must have testicle or nipple placed in a vice and slowly tightened until...

    Oh, wait, that's the divorce tactic.

    What the heck, it'd probably work for spammers, too.

  • why new TLD for paid reputation service? (Score:5, Insightful)

    by jdunlevy ( 187745 ) on Thursday March 25, 2004 @06:28PM (#8674062) Homepage
    Why not just create a paid whitelist (or lists) along the same lines as a dnsbl, charge companies to register and require that they abide by certain practices for being listed? What does a new TLD add other than additional ICANN bureaucracy?
    • Another point is that such a whitelist could use current systems to operate (just add the parameters to the current blacklist system). This .mail TLD would require new software to check for the existence of a .mail TLD. Thus, a .mail TLD is *worse* than the whitelist that you propose.

  • Yeah But... (Score:5, Insightful)

    by aduzik ( 705453 ) on Thursday March 25, 2004 @06:28PM (#8674063) Homepage
    Spammers are a crafty bunch. They've defeated just about every mechnaism for preventing unauthorized mail server use/relaying/etc. How long until they find a way to get their own .mail server? And also, I would venture to say that most legitimate orgs -- small businesses, personal web site owners, and non-profit organizations in particular -- will not want to, nor be able to shell out two grand for YAD (yet another domain).

    I think recent innovations -- SPF being my favorite so far -- offer a lot more promise than a new TLD. But that's just me :-)

    • Re:Yeah But... (Score:3, Offtopic)

      by taustin ( 171655 )
      How long until they find a way to get their own .mail server?

      Spammers have been using their own mail servers for years. And now they're using virus zombie networks anyway, which this won't stop.

    • Re:Yeah But... (Score:3, Insightful)

      by mdfst13 ( 664665 )
      About the same amount of time that it would take them to get an SPF domain. That's what blacklists are for. It is a lot easier to blacklist spam.mail or spam.com (in the SPF case) than it is to blacklist every IP that sends spam (especially with DHCP).

      The thing that I like least about a new TLD is that it brings back relaying. Since it is going to be impractical to get a .mail for everyone who maintains a personal email server, most people who do this now are going to hire a relay server.

      There is a cur

  • Why a TLD? (Score:4, Interesting)

    by The Famous Brett Wat ( 12688 ) on Thursday March 25, 2004 @06:31PM (#8674086) Homepage Journal
    Why do they need the .mail TLD to pull this off? Why not just go right ahead and do it under mail.spamhaus.org? Is it the air of official legitimacy associated with a TLD that they're after?

    • Re:Why a TLD? (Score:4, Insightful)

      by SydShamino ( 547793 ) on Thursday March 25, 2004 @06:48PM (#8674217)
      Can you imagine a company like Charles Schwab ever sending out mail with a domain like schwab.mail.spamhous.org? I can't either. However, a company like that would buy a schwab.mail domain. This has everything to do with companies demanding a professional look and feel to their image.

      No, I don't think this is a good idea. But I see why a top level domain is necessary to pull it off.
    • With a little research, I've managed to pretty much answer my own question, and the answer is, "yes, they're doing it for the air of official legitimacy" -- more or less. The answer is in the .mail TLD FAQ [spamhaus.org], question 15, which I'll reproduce here for your convenience, so you can see it in their own words.

      15) Couldn't this be done using a normal example.com type domain instead of creating a TLD?

      Yes... but in reality no. In truth, *any* TLD could really be a SLD (second level domain). In fact, many are (

      • ... to me that the people behind the proposal are complete morons.

        As someone pointed out in a thread above there is no good reason to just use a reverse blacklist (like DNSRBL et al.) which identifies certain senders as non-spammers instead of identifying them as spammers.

        "[...] set up to be more robust and attack resistant [...]". Oh please. If you get $2k from each and every person/corp. in your whitelist you sure as hell can afford some professional DNS hosting for your whitelist.
  • Having rules for who can spam (or send bulk email, whatever) but I really dont' care about that. What I want is a reliable way to accept the mail I want. Right now it's using a spam filter, because even "legitimate" mail from companies that have opt out mechanisims are mail that I don't personally want to see. So they get filtered out with all the rest, and I'm left with (mostly) the mail that I want to get from friends, family, mailing lists, and whatnot.

    Even having a legit .email domain isn't going to

  • Wonderful, we finally have the motivation... (Score:3, Insightful)

    by pla ( 258480 ) on Thursday March 25, 2004 @06:43PM (#8674180) Journal
    for a major schizm of internet mail protocols.

    Which will leave "companies able to pay $2k/year" on one side, and "individuals capable of installing their own mail server" on the other.

    This will cause a bit of disruption at first, as a few competing standards emerge, but in the long run, it will make blocking corporate traffic far easier (yeah, I get soooo much legit email from non-individuals... I think I can count the past year's on one hand). And with a bit of care, the non-corporate protocol will finally include several of the oft-discussed but as-yet-unimplemented techniques for completely locking out spam (or at least making it trivial to identify the source).

    And encryption. Don't forget encryption. The non-corporate protocol should include end-to-end crypto, now that Big Brother can watch us on a whim right from the privacy of our own ISP's back door.

  • 2000 per year? (Score:3, Interesting)

    by fdawg ( 22521 ) on Thursday March 25, 2004 @07:04PM (#8674358)
    Wouldnt that cost be pushed to the end user? Doesnt that mean we're going to have to pay for email?

    Sounds like a recipe for email tax. I think the only way to really stop this is to stop the 200 or so people per spam message that actually respond to spam and make it a profitable business.

  • So eventually... (Score:5, Insightful)

    by .@. ( 21735 ) on Thursday March 25, 2004 @07:16PM (#8674442) Homepage
    the only email that'll make it past everyone's spamfilters would be that from MXes in the .mail TLD. ...and those of us who can't shell out $2k/year just to have our private domain in .mail are just screwed.

    Brilliant idea. While we're at it, why don't we just let ICANN authoritatively say who can and can't send mail, and be done with it? It's not like their board is captured or anything.

  • Worthless (Score:4, Interesting)

    by macdaddy ( 38372 ) on Thursday March 25, 2004 @07:16PM (#8674443) Homepage Journal
    I can't for the life of my figure out what the hell Steve is thinking.

    If a company or provider isn't sending or supporting spam then why the hell would give a damn about someone else's spam filters? That is the only reason for this whitelist. I mean if they aren't sending spam then why should they be concerned about loosing mail to someone else's spam filters? Why would they want to drop $2k per domain for another whitelist? If perhaps I was a company that did mass mail customers like Sears, JCPenny's, or Amazon then maybe I would want to get on a popular whitelist. That said, why in the hell would I as an average joe or I as a typical ISP give a hoot about what someone else's spam filters do with my non-spam? If their filters are mistakenly tagging my mail as spam their customers will bitch and the problem will get fixed. It doesn't concern me.

    I really don't see the point in a .mail TLD. Steve is a smart guy. Even at that I absolutely can not see his reasoning here. This is really a dumb idea. I make a point to personally blacklist domains that use tools that break email such as TMDA. I guess I'll just have to add another check to my rules.

    • Re:Worthless (Score:4, Interesting)

      by macdaddy ( 38372 ) on Thursday March 25, 2004 @07:43PM (#8674682) Homepage Journal
      Yes, I'm replying to my own post now.

      I was just reading the .mail STLD RFP application [icann.org] and am finding myself suprised by the people associated with the hair-brained idea.

      Initial Board of Directors

      Steve Linford, founder of Spamhaus.org

      Joseph E. St. Sauver, Ph. D, Director, User Services and Network Applications Unv of Oregon

      Already consented to be special advisors to the SO

      John Levine, Chairman of the Anti-Spam Research Group (ASRG) of the Internet Research Task Force (IRTF)

      Wietse Zweitze Venema, Ph.D, Postfix author among other things

      Other

      Justin Mason or Daniel Quinlan of SpamAssassin.org

      Eric Allman of Sendmail.org

      Ted Galvin of SpamCon.org

      Suresh Ramasubramanian of OutBlaze.com

      That list amazes me. I can't believe those people would have anything to do with this project. I also can't believe they are intentionally involving Verislime. I wonder if this is an attempt to counter Microsoft's e-stamp proposal...

    • Re:Worthless (Score:3, Insightful)

      by SpacePunk ( 17960 )
      You wanna know what he's thinking? KA-CHING!

      1. Get into the anti-spam biz.
      2. Talk ICANN into a .mail TLD with your org as the registrar!
      3. PROFIT!

      If you wish to debate #2 just think about it for a bit.

      The .mail TLD will not stop spam, spam-trojans, or anything of the like. It would be trivial for a spam trojan on a compromised machine to look into the configuration of any email software installed, extact the SMTP server name and just simply send through that server instead of sending directly to the

  • What, the, fuck. (Score:4, Insightful)

    by autopr0n ( 534291 ) on Thursday March 25, 2004 @07:17PM (#8674452) Homepage Journal
    This is the most asinine thing ever. First of all no one is every going to implement something like this that requires someone not to comply with US law. It just won't happen.

    Secondly, wtf. $2000 a year? That's insane. Right now, I can use my own mail server and only pay the $8/year domain registration fee. And that's the way it should be. People with enough tech savvy (and it doesn't take much these days) should be running their own mail servers. Open relays aren't an issue with modern mail servers (you have to work pretty hard to create one these days), and running your own mail server gives you a lot of fine-grained control over how you filter Spam for yourself (for example, using a catch-all email and using a different email for everything, letting you track how your address gets disseminated, and blocking addresses that get 'liberated')

    It seems like some of these anti-Spam people hate Spam so much they completely lose track of what Email is for and the people it's supposed to be used by, everyone. Email black holes are one thing, but it's wrong to apply them as filters for people without their knowledge or consent. I read a salon article about a woman who, when roadrunner implemented RTBL she lost out on tons of email, including email from potential employers (she was a freelance author). She still got tons of Spam, of course.

    I don't believe that technical solutions alone will stop Spam, but they, with real legal enforcement can probably reduce it a lot.

    I'm also tired of these top-down authoritarian systems that put a few people in control of email (like e-stamps, or this insane plan, etc) before we even get good solutions like SPF working. Once people start checking SPF records a lot of this crap will get a lot better.

  • When will everybody just implement SPF (Score:3, Interesting)

    by jonwil ( 467024 ) on Thursday March 25, 2004 @07:27PM (#8674535)
    SPF is close to the best anti-spam idea out there.
  • Everyone on Slashdot sends one email to spamhaus.org.

  • ambiguous english (Score:3, Insightful)

    by Stephen Samuel ( 106962 ) <samuel@@@bcgreen...com> on Thursday March 25, 2004 @07:48PM (#8674717) Homepage Journal
    ... companies that comply with the US CAN-SPAM act - ...- would not be eligibile to register a .mail address.

    That should have been "might not be eligible to register a .mail address.

    In all probability, most people would be compliant with both CAN-SPAM and the .mail requirements (modulo being willing to pay $2K/year to send email).

  • 2k ? (Score:4, Insightful)

    by 1lus10n ( 586635 ) on Thursday March 25, 2004 @07:51PM (#8674744) Journal
    Someone please explain to me exactly how a smal/mid-size locally owned bussines can afford 2k to send mail ? They claim spammers wont pay the 2 grand on their webpage, thats bullshit. Spammers can and will pay this. You will however be excluding small bussiness's and personal domains.

    And also exactly WHERE the money is going to ? The last thing we need is one governing body trying to control mail for the "betterment of all, so long as it helps our bottom line". We dont need a spam czar, or a spam conglomerate. We need the existing people to work together to prevent spam. ALL spam.

    This is a half assed idea.

  • I don't see the point... (Score:5, Insightful)

    by eaolson ( 153849 ) on Thursday March 25, 2004 @08:18PM (#8674968)

    I'm just not getting how this proposal would do much. I read through the text of the proposal [icann.org], which is written in fairly obtuse language I just couldn't quite plod through right now.

    • OK, so we'll have this .mail TLD. Since any domain name just resolves to an IP address, this proposal would just boil down to keeping a list of trusted IP addresses. In other words, a list of trusted mailservers, which can easily be done with what exists now.
    • What happens when spam originates from a .mail address? Because it will, if only from a virus-compromised machine. It seems the only recourse would be the revocation of the .mail domain.
    • And if so, what is to stop a spammer from signing up, sending off a one-shot spam run, and losing the domain? It will just raise the cost of each spam run by the cost of registering the .mail domain. That certainly might *help* reduce spam, but it depends on the amount of spam they could send through before losing the domain.
    • I assume each ISP will have a .mail domain of the sort isp.com.mail, and their customer's email will be routed through it. So what happens when a customer of an ISP decides to spam? Will this committee be tasked with determining whether the ISP terminates their spamming customer within an "acceptable" timeframe?
    • It is already known that there are a number of less-than-entirely-responsible ISPs and even some that are explicitly spam-friendly. For a sufficiently large organization, they could afford to go through .mail domains at a fairly high rate.
    • The cost also seems to be a problem. It seems that this proposal can ONLY work if the cost of the .mail domain is fairly high. It seems that the cost will probably be somewhere between $200 and $2000. This seems prohibitive for individuals, non-profits, and third-world orgs.

  • I said it before, and I'll say it again (Score:3, Insightful)

    by dacarr ( 562277 ) on Thursday March 25, 2004 @09:59PM (#8675819) Homepage Journal
    Like I mentioned in the prior discussion on this, just because you have a .mail TLD won't stop spammers. TLDs are in DNS, and in the final analysis, it's all arbitrary, as you can use ANY word as a top level domain. That's why you have alternate roots like OpenNIC [unrated.net].

  • This will not work. (Score:3, Interesting)

    by rice_burners_suck ( 243660 ) on Thursday March 25, 2004 @11:45PM (#8676542)
    The "agree to abide" thing is probably good. Perhaps there should be some law (or something similar) that those .mail domain name holders who do not abide by the rules are fined, and after so many fines, they are blocked from using a .mail TLD for a period of 100 years or something.

    On the other hand, the $2000 a year fee isn't going to do jack. Those who send spam do so because it's really darn profitable. To them, the $2000 a year is peanuts. To a service provider who can barely make ends meet and wants to expand its quality of service and options for customers, $2000 may be the difference between breaking even and going bankrupt. That's kind of like trying to protect individual inventors working in their basement by making the patent fees $200,000 or something. That'll only serve to accomplish the opposite of the intended result.

    The bottom line is this: Make it difficult for spammers, not for legitimate users. A certain standard should be devised that includes technical as well as contractual devices to make it extremely difficult for any spammer to last any time at all on the .mail TLD. And mail received from non-.mail TLDs could automatically go into a "bulk mail" folder, or would not be downloaded from the server at all, except for the "From:" address and perhaps a digital signature, so the user (or his filters) can decide what to do with that information. And maybe that needs to happen with ALL mail, not just non-.mail TLD mail.

  • This is bad, just like .kids and .xxx (Score:3, Interesting)

    by Fastolfe ( 1470 ) on Friday March 26, 2004 @08:45AM (#8678898)
    The Internet is not e-mail! It is completely inappropriate to base the DNS name of your organization on what is effectively a content label specific to one particular service. This is the same reason .kids and .xxx are bad.

    Heck, let's say I run a porn service, and want to take advantage of this mail feature. I now have to use two different DNS domains? That's stupid.

    Just as PICS can give you digitally-signed content ratings for the web, some other service can give you digitally-signed ratings/labels for e-mail. Extend SMTP to, perhaps, operate over TLS or SSL, or at least perform some sort of mutual check that both sides have a SpamHaus certificate that says they're not a spammer, and you can possibly "secure" the connection.

    Or just digitally sign your e-mail messages and only accept digitally-signed e-mail. Tweak your trust relationships (for PGP-style signatures) or drop your trust from any roots that are seen to sponsor spammers, and you're all set.

Slashdot Top Deals

"The pyramid is opening!" "Which one?" "The one with the ever-widening hole in it!" -- The Firesign Theatre

Close