To: Eric Allman <eric@reference.com>
Cc: Harald.T.Alvestrand@uninett.no, drums@cs.utk.edu
Subject: Re: My opinion on VRFY 
In-Reply-To: Your message of "Wed, 06 Dec 1995 09:22:41 MDT."
             <199512061522.JAA00932@jean-baptiste.internetMCI.ietf.org> 
Date: Thu, 07 Dec 1995 07:51:29 +1100
Message-Id: <4407.818283089@munnari.OZ.AU>
From: Robert Elz <kre@munnari.oz.au>


    Can you suggest a way to word the spec ..

I will look at this after I get home.

    Or are you suggesting an algorithm along the line of:
    
    if owner-X exists
    	verify owner-X
    else
    	for all members of X
    	    verify the member

Yes.   Exactly that.
    
    If so, this is still an unbounded algorithm

Yes.    Maybe it would be sufficient to test that one address
is valid, pick one at random, I'm not sure.  I would like to think
that the better test is "can I send to here without having mail
bounce to me", for which the owner-alias in sendmail is the check,
but perhaps having one valid address, so I can send and have mail
delivered to at least soemone is enough?
    
    I claim that if the point is to verify that an address is plausible
    (e.g., when it is being added to a mailing list or used in an HTTP
    transaction) then the current sendmail algorithm is sufficient.

The problem is that may users have old addresses at various places
implemented by way of alias entries.   If simply testing the alias
is sufficient, those will all generate "ok".  However, many have
the alias point into oblivion - when asked to fix that, the admin of
the aliases file usually simply deletes the alias (no idea what to
change it to), which is reasonable.  Thus verification of existance
of an alias itself is really verification of nothing.


    I don't understand this.  You seem to be saying that all UUCP addresses
    will verify bad.  Although John Myers might agree with this, I suspect
    many others might disagree.

No.  Perhaps I picked the wrong code, I meant that the mailer
shoudl reply "I am not going to do that verification", which is
one of the possible responses, "address is good", "address is bad",
"I refuse to say one way or the other".   If the address is
someplace out where we have no idea, and cannot tell, whether
the address is OK or not, saying either yes or no seems wrong to
me, we should just say "don't know" (ie: "I won't say").

We could use that approach for the big alias problem too, any
implementation woudl be free to decide that verifying this address
is too much work to do, and simply refuse.

kre