[MlMt] Bounce to Sender

[Bill Cole]

On 30 May 2014, at 0:14, Gary Hull wrote:

> I think I may have read an old thread there where Benny may have 
> expressed his opposition to this idea because it flouted RFC gospel, 
> but Mail.app used to have a Bounce to Sender option where you could 
> send a sort of counterfeit bounced e-mail to trolls or people from 
> your past who you're not thrill have tracked you down.

Note that "flouted RFC gospel" should be understood to mean "amounted to 
material fraud."

Speaking from the viewpoint of a mail admin and erstwhile abuse desk 
wrangler: that misfeature in Mail.app and a few Unix MUAs was a harmful 
nuisance whose extermination has been an unalloyed good.

> This was a lot of fun, I have to admit, and I missed it when I 
> switched to Gmail. If you examined the headers closely, I think you 
> could figure out that it wasn't a real bounced e-mail, but that was 
> beyond the ability of most people.

I'll refrain from sharing my estimation of the median email 
comprehension of email users, but it is in fact quite simple to tell 
that the best possible fake bounce is fake, unless the fake is generated 
and submitted on the original target's final delivery mail server which 
has software and configurations that have been obsolete since the 
mid-90s. That's why the fake bounce seemed feasible for some classical 
Unix MUAs from that era. In the modern email world the fake bounce may 
not be detected as fake by an intended recipient, not because that is 
hard to do but because robotic spam control mechanisms notice the fraud 
in transit, either as a real asynchronous bounce (widely recognized as 
problematic "blowback" from forged spam) or as the fraud it is. Either 
way, the fake bounce itself can damage the public reputation of the 
server handling it, making it more likely that legitimate mail from the 
same system will be shunned and *properly* making it reasonable for the 
mail provider to cut off the user engaging in the fraud. This becomes a 
bigger problem in light of the fact that some users who are offered the 
"bounce" misfeature will be entirely ignorant of its limitations and 
risks, and will use it in unjustifiable circumstances and/or high 
volume.

In short: fake bounce functionality is a trap that is more likely to 
cause users to *JUSTIFIABLY* lose their email accounts than it is to 
result in the outcomes they seek.