Re: use of abuse@........

[Rodney Tillotson <]

At 09:51 24/08/2001, paul.chamberlain@localhost wrote:

 > Is there any legal or RFC compliance/requirement for using the mail
 > address of abuse@.. as the 
 > address for such reporting or is it a convention used by ISP's.

Legal, No.
RFC, Yes but see below. (Furio Ercolessi has just provided this ref).
Convention, Yes but see below.

    
RFC 2142 is all there is. It says that an organisation MAY support an
mailbox name

  "to provide recourse for customers, providers and others who are
   experiencing difficulties with the organization's Internet service";

that where the difficulty is 'inappropriate public behaviour', the
address MUST be 'abuse';

and that support for that mailbox name MUST
  "[result] in delivery to a recipient appropriate for the referenced
   service or role".

(RFC 2142 does not claim to use MAY and MUST in the manner of
RFC 2119. The upper case here is mine.)


I interpret this to mean that if you have an external abuse function
'abuse' has to be one of the addresses that reach it, and if you have
an 'abuse' address it has to reach people who actually perform the
abuse function. This RFC doesn't say you have to have either thing.

In practice it seems to me that the good guys provide an abuse
function and use the abuse address to reduce the load on postmaster,
webmaster and other guessable addresses. This is consistent with
RFC 2142.
The less good guys provide no abuse function, so they should not
provide an abuse address; if they do it may be a black hole or an
address harvester.

Requiring people to use a different address for the abuse function
(eg abuse-mail) is contrary to RFC 2142 -- though if you claim that
'abuse' works but a more specific address will enable a faster
response that's perhaps OK.
Requiring people to use a different technology (eg Web form or fax)
is contrary to the RFC; though again it may be helpful for certain
people and is probably acceptable as an alternative.


My impression is that the presence and the effect of an 'abuse'
address to the left of the '@localhost are less of an issue than the
difficulty of working out which domain name to put after '@localhost --
which the other current thread on this list is discussing.

Rodney Tillotson, JANET-CERT
+44 1235 822 255.