marf K. Li
Internet-Draft B. Leiba
Intended status: Standards Track Huawei Technologies
Expires: January 3, 2012 July 2, 2011
Email Feedback Report Type Value : not-spam
draft-ietf-marf-not-spam-feedback-00
Abstract
This document defines a new Abuse Reporting Format (ARF) feedback
report type value: "not-spam". It can be used to report a message
that was mistakenly marked as spam.
Status of this Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 3, 2012.
Copyright Notice
Copyright (c) 2011 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
(http://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
include Simplified BSD License text as described in Section 4.e of
the Trust Legal Provisions and are provided without warranty as
described in the Simplified BSD License.
Li & Leiba Expires January 3, 2012 [Page 1]
Internet-Draft Email Feedback Type: not-spam July 2011
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Discussion . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4
2. Feedback Report Type: Not-Spam . . . . . . . . . . . . . . . 4
3. Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
4. Security Considerations . . . . . . . . . . . . . . . . . . . 5
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 6
6. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 6
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 6
7.1. Normative References . . . . . . . . . . . . . . . . . . . . 6
7.2. Informative References . . . . . . . . . . . . . . . . . . . 6
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . 7
Li & Leiba Expires January 3, 2012 [Page 2]
Internet-Draft Email Feedback Type: not-spam July 2011
1. Introduction
In RFC 5965 [RFC5965], an Abuse Reporting Format (ARF) is defined for
reporting email abuse. Currently two feedback report types are
defined that are related to the spam problem, and that can be used to
report abusive or fraudulent email messages:
o abuse: indicates unsolicited email or some other kind of email
abuse.
o fraud: indicates some kind of fraud or phishing activity.
This specification defines a new feedback report type: "not-spam".
It can be used to report a message that was mistakenly marked as
spam.
1.1. Discussion
In some cases, the mail client receives an email message that was
tagged as spam, either by the mail system or accidentally by the
user, but the end user finds that actually it is not spam. The mail
client accepts the end user's report instruction and retrieves
information related to the message, and reports this email as not-
spam to the mail operator. When the mail operator receives the
report, it can determine what action is appropriate for the
particular message and user. (The requirement for a not-spam report
type is from the Open Mobile Alliance (OMA) Spam Report Requirement
Document [OMA-SpamRep-RD].)
For example, in response to a "not-spam" report the mail system can
remove the spam tag or change the category, possibly preventing
future similar mail for this user from being marked as spam. The
report can be used to adjust the training of an automated classifier.
After processing the report, the mail operator can send a
notification to the mail client about the processing result.
In most cases, "not-spam" reports will probably not be taken on their
own, but will be considered along with other information, analysis of
the message, etc. Because different users have different needs and
different views of what constitutes spam, reports from one user might
or might not be applicable to others. And because users might
sometimes press a "report not spam" button accidentally, immediate
strong action, such as marking all similar messages as "good" based
on a single report, is probably not the right approach. Recipients
of "not-spam" reports need to consider what's right in their
environments.
There are anti-spam systems that use "not spam" feedback today. All
of them take the reports and mix them with other spam reports and
other data, using their own algorithms, to determine appropriate
Li & Leiba Expires January 3, 2012 [Page 3]
Internet-Draft Email Feedback Type: not-spam July 2011
action. In no case do the existing systems use a "not spam" report
as an immediate, automatic override.
1.2. Terminology
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in [RFC2119]. These
terms take their normative values only when presented in UPPER CASE.
2. Feedback Report Type: Not-Spam
This document only defines a new feedback report type, "not-spam",
extending the Email Feedback Reports specification [RFC5965].
In the first MIME part of the feedback report message, the end user
or the mail client MAY add information to indicate why the message is
not spam -- for example, because the originator or its domain is well
known.
3. Example
In the example, Joe, a pharmaceuticals sales representative, has
received a message about discount pharmaceuticals. Because that is a
frequent subject of spam email, the message has been marked as spam
-- incorrectly, in this case. Joe has reported it as "not-spam", and
this is an example of the report.
Note that the message is DKIM-signed [I-D.ietf-dkim-rfc4871bis], a
good security practice as suggested in RFC 5965 section 8.2
[RFC5965].
DKIM-Signature: v=1; a=rsa-sha256; s=abuse; d=example.com;
c=simple/simple; q=dns/txt; i=abusedesk@example.com;
h=From:Date:Subject:To:Message-ID:MIME-Version:Content-Type;
bh=iF4dMNYs/KepE0HuwfukJCDyjkduUzZFiaHqO9DMIPU=;
b=e+BF8DCHFGqCp7/pExleNz7pVaLEoT+uWj/8H9DoZpxFI1vNnCTDu14w5v
ze4mqJkldudVI0JspsYHTYeomhPklCV4F95GfwpM5W+ziUOv7AySTfygPW
EerczqZwAK88//oaYCFXq3XV9T/z+zlLp3rrirKGmCMCPPcbdSGv/Eg=
From: <abusedesk@example.com>
Date: Thu, 8 Mar 2005 17:40:36 EDT
Subject: FW: Discount on pharmaceuticals
To: <abuse@example.net>
Message-ID: <20030712040037.46341.5F8J@example.com>
MIME-Version: 1.0
Li & Leiba Expires January 3, 2012 [Page 4]
Internet-Draft Email Feedback Type: not-spam July 2011
Content-Type: multipart/report; report-type=feedback-report;
boundary="part1_13d.2e68ed54_boundary"
--part1_13d.2e68ed54_boundary
Content-Type: text/plain; charset="US-ASCII"
Content-Transfer-Encoding: 7bit
This is an email abuse report for an email message received
from IP 192.0.2.1 on Thu, 8 Mar 2005 14:00:00 EDT.
For more information about this format please see
http://www.mipassoc.org/arf/.
--part1_13d.2e68ed54_boundary
Content-Type: message/feedback-report
Feedback-Type: not-spam
User-Agent: SomeGenerator/1.0
Version: 1
--part1_13d.2e68ed54_boundary
Content-Type: message/rfc822
Content-Disposition: inline
Received: from mailserver.example.net
(mailserver.example.net [192.0.2.1])
by example.com with ESMTP id M63d4137594e46;
Thu, 08 Mar 2005 14:00:00 -0400
From: <someone@example.net>
To: <Undisclosed Recipients>
Subject: Discount on pharmaceuticals
MIME-Version: 1.0
Content-type: text/plain
Message-ID: 8787KJKJ3K4J3K4J3K4J3.mail@example.net
Date: Thu, 02 Sep 2004 12:31:03 -0500
Hi, Joe. I got a lead on a source for discounts on
pharmaceuticals, and I thought you might be interested.
[...etc...]
--part1_13d.2e68ed54_boundary--
Example 1: Not-spam report
4. Security Considerations
All of the Security Considerations from the Email Feedback Reports
specification [RFC5965] are inherited here.
Li & Leiba Expires January 3, 2012 [Page 5]
Internet-Draft Email Feedback Type: not-spam July 2011
Not-spam reports could possibly be used in an attack on a filtering
system, reporting true spam as "not-spam". Even in absence of
malice, some not-spam reports might be made in error, or will only
apply to the user sending the report. Operators need to be careful
in trusting such reports, beyond their applicability to the specific
user in question.
5. IANA Considerations
Registration is requested for the newly defined feedback type name:
"not-spam", according to the instructions in section 7.3 of the base
specification [RFC5965].
Please add the following to the "Feedback Report Type Values"
registry:
Feedback Type Name: not-spam
Description: Indicates that a message is not spam. This may be used
to correct a message that was incorrectly tagged or categorized
as spam.
Published in: this document
Status: current
6. Acknowledgements
The authors would like thank Murray S. Kucherawy and Bert
Greevenbosch for their discussion and review, and J.D. Falk for
suggesting some explanatory text.
7. References
7.1. Normative References
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC5965] Shafranovich, Y., Levine, J., and M. Kucherawy, "An
Extensible Format for Email Feedback Reports", RFC 5965,
August 2010.
7.2. Informative References
[I-D.ietf-dkim-rfc4871bis]
Crocker, D., Hansen, T., and M. Kucherawy, "DomainKeys
Identified Mail (DKIM) Signatures",
draft-ietf-dkim-rfc4871bis-13 (work in progress),
Li & Leiba Expires January 3, 2012 [Page 6]
Internet-Draft Email Feedback Type: not-spam July 2011
June 2011.
[OMA-SpamRep-RD]
Open Mobile Alliance, "Mobile Spam Reporting
Requirements", OMA-RD-SpamRep-V1_0 20101123-C,
November 2010.
Authors' Addresses
Kepeng Li
Huawei Technologies
Huawei Base, Bantian, Longgang District
Shenzhen, Guangdong 518129
P. R. China
Phone: +86-755-28974289
Email: likepeng@huawei.com
Barry Leiba
Huawei Technologies
Phone: +1 646 827 0648
Email: barryleiba@computer.org
URI: http://internetmessagingtechnology.org/
Li & Leiba Expires January 3, 2012 [Page 7]
