Subject: New proposal for the interactive message tracking protocol

From: Roland Brand <[email-masked]>
Date: Thu, 23 Dec 1999 10:43:29 +0100 (CET)

I would like to start discussion about a counter-proposal for a message
tracking system.

This solution fits to the post-hoc model defined in the model document.
Instead of adding a new command to SMTP for tracking, I would rather
create a new tracking protocol. SMTP would then only have to be slightly
adapted, so that it logs every message traversal. The logged information
would have to be written to a database in a unified way, so that every
message gets a unique tracking identifier, as described in the model
document.

A special tracking entity would then use this database to answer tracking
requests. These requests use some form of authenticator, which may be the
one described in the model document.

The user would then have a tracking agent, which collects the information
about a particular message from the different tracking entities.

The advantages of this solution are:

1. The same tracking protocol can also be used for other systems than
SMTP. It could then provide information about the whereabouts of a message
in an X.400 or even a proprietary system. Furthermore there could be
information as "fetched through POP3" and so on.

2. The tracking activity is kept away from the e-mail system, so that an
SMTP server cannot be saturated with tracking requests by malicious users.

3. It requires only slight changes in SMTP, namely to generate the logs.
This prevents us from creating a real monster of a protocol.

From my point of view the protocol independency mentioned in point 1 is of
primary importance, since it increases the quality of the tracking service
a lot. The other protocols would only have to create the same kind of log
entries, so that the software used for tracking could be remain exactly
the same.

I am about to build a prototype implementation during my diploma thesis at
the Swiss Federal Institute of Technology and I would appreciate to get
your opinion on it.

Yours sincerely

---
Roland Brand
Student at Swiss Federal Institute of Technology (ETH)
[email-masked]

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 23 Dec 1999 18:54:33 -0700

---

From: Alexey Melnikov <[email-masked]>
Date: Thu, 23 Dec 1999 19:12:17 -0700

Sorry, the previous message was accidental!

> > SMTP server cannot be saturated with tracking requests by malicious users.

This is good point.

> > 3. It requires only slight changes in SMTP, namely to generate the logs.

In most cases MTA already generate logs. The only change would be to add
records to some sort of temporary message tracking database.
Saying that, it would be simpler to extend SMTP than create new
protocol. Writing to message tracking database would be already in MTA,
so it would be easy in many cases to add querying the database. IMHO,
adding such query command would be as easy as adding support for VRFY
command when server already has RCPT TO:.

> > This prevents us from creating a real monster of a protocol.

Anyway, to leverage existing code it is better if not to extend SMTP,
but at least use SMTP syntax.
Also in Washington it was proposed to use DSN format for the response to
such command.