Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Well, for the first two or three years of the problem, the solution will be to blacklist IPv6 in toto. If you're not "good enough" to have an IPv4 address to send mail from, then you lose.

I'm not saying this is perfect or endorsing it, I'm just saying that this is what is going to happen. It's not even an interesting problem until you have actual mail coming from IPv6-only addresses on a routine basis, and that happens well after the IPv6 switchover, which still hasn't happened.



So how will that work for gmail? They can't throw away their entire userbase because they don't have ipv4.


Expanding on what pkulak said, it's the mail servers that send mail, not users. There will actually be quite a long time during which everybody can still reach an IPv4 server. They may even reach it over an IPv6 address, but when the mail leaves "your corporate network" or "Comcast", it can be over IPv4. So even a brand new ISP in a brand new country with brand new network addresses and no other IPv4 connectivity can still have one IPv4 mail server somewhere. (IPv4 addresses aren't so rare than ISPs can't have them, what we can't do is hand them out to every individual on the planet.)

And since in the early phases of the transition anybody wanting to send mail will need to do this anyhow, there will be a long period of time (couple of years) where pretty much all mail coming from an IPv6 address will be a spammer trying to get around IPv4 IP reputation lists. And the solution will be to blacklist IPv6 as a whole, and that solution will be deployed until it becomes too painful. Following that will be whitelisting specific known good IPv6 addresses, which will probably hold for at least another year. Only then will be actually be thrust into the chaos of a network where you can't use blacklisting, and, well, I actually still have some ideas on that front so I'm not sure it's hopeless even then. (But I can't test the ideas against reality until about year 2 of this process at the earliest.)

Again, let me highlight I'm not endorsing this; my first post has been bouncing up and down between 0 and 1 and I suspect there's some people missing this point. I'm just saying, it's what is going to happen. Mail filtering is very much an engineering problem, not a science problem, and you can sing the virtues of IPv6 to the mail server admins all you want but they do not care.


There is mail being exchanged over v6 today. Most of it is legitimate at this point although there are v6 spammers operating already, of course. The volume is still pretty light but it's definitely not zero.

It' still possible to use blacklisting at the ASN or netblock level in v6. I have no doubt that people will do this despite the extensive collateral damage it causes. This type of wide blacklists are a reality in the v4 world also and they cause damage there too.

I expect SPF, DKIM, and content inspection will become more primary as DNSBLs lose effectiveness in a v6 world. Right now you can skip this type of processing on 50-90% of inbound attempts thanks to the DNSBLs effectiveness. It can be a huge cost burden to to process the amount of crap being sent by spammers so SPF is the best option but it can't do the job without the other pieces.


Google needs the ip4 address in this scenario, not the user.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: