| 1 | Variable Envelope Return Paths |
| 2 | D. J. Bernstein, djb@pobox.com |
| 3 | 19970201 |
| 4 | |
| 5 | |
| 6 | 1. Introduction |
| 7 | |
| 8 | The fundamental problem in managing a large mailing list is matching |
| 9 | bounce messages to subscription addresses. |
| 10 | |
| 11 | Often a bounce message refers to a failing address that does not |
| 12 | appear on the mailing list. One of the mailing list subscribers is |
| 13 | forwarding messages to that address. Which subscriber? As the list |
| 14 | grows, this question becomes more and more difficult to answer. |
| 15 | |
| 16 | Sometimes a bounce message doesn't identify the address that failed. |
| 17 | On occasion it doesn't even include a copy of the original message. |
| 18 | See RFC 1211 for an extensive collection of horror stories. |
| 19 | |
| 20 | In theory, one could solve this problem with the DSN option and DSN |
| 21 | format described in RFC 1891, RFC 1892, and RFC 1894. Unfortunately, |
| 22 | the DSN option is useless unless it is supported by every |
| 23 | intermediate MTA. The complexity of RFC 1891 means that it will be |
| 24 | many years, perhaps infinitely many, before DSNs are universally |
| 25 | supported. Furthermore, the complexity of RFC 1894 means that parsing |
| 26 | the subscriber address is difficult even on the occasions that the |
| 27 | address is available. |
| 28 | |
| 29 | Variable envelope return paths (VERPs) completely eliminate this |
| 30 | problem _right now_. They automatically and reliably identify the |
| 31 | subscription address relevant to each bounce message. They provide |
| 32 | the address in a form that is trivial for automated bounce handlers |
| 33 | to parse. They require support from the local mailer, but they do not |
| 34 | require support from any other hosts. |
| 35 | |
| 36 | |
| 37 | 2. Variable envelope return paths |
| 38 | |
| 39 | Here is how VERPs work: each recipient of the message sees a |
| 40 | different envelope sender address. When a message to the |
| 41 | djb-sos@silverton.berkeley.edu mailing list is sent to |
| 42 | God@heaven.af.mil, for example, it has the following envelope sender: |
| 43 | |
| 44 | djb-sos-owner-God=heaven.af.mil@silverton.berkeley.edu |
| 45 | |
| 46 | If the message bounces, the bounce message will be sent back to |
| 47 | djb-sos-owner-God=heaven.af.mil@silverton.berkeley.edu. |
| 48 | |
| 49 | If God is forwarding His mail, the bounce message will still go to |
| 50 | djb-sos-owner-God=heaven.af.mil@silverton.berkeley.edu. No matter how |
| 51 | uninformative the bounce message is, it will display God's |
| 52 | subscription address in its envelope. |
| 53 | |
| 54 | Another benefit of VERPs is that God Himself can see what address He |
| 55 | used to subscribe. |
| 56 | |
| 57 | Making VERPs work requires two pieces of local software support. |
| 58 | First: it must be easy to modify the outgoing sender address |
| 59 | separately for each envelope recipient. For example, with one mailer, |
| 60 | qmail, a user can simply touch ~/.qmail-list-owner and |
| 61 | ~/.qmail-list-owner-default to apply VERPs to user-list. |
| 62 | |
| 63 | Second, and more important: it must be easy to identify a collection |
| 64 | of addresses, such as djb-sos-owner-*, and send all mail for those |
| 65 | addresses to one place, while preserving the * information. Under |
| 66 | qmail, all user-list-owner-* mail will be sent to the user once he |
| 67 | touches ~/.qmail-list-owner-default. Sending the mail through an |
| 68 | automated bounce-handling program is just as easy. |
| 69 | |
| 70 | With older mailers, applying VERPs would require setting up a new |
| 71 | user-list-owner-recipient alias for each new recipient. This |
| 72 | inconvenience has prevented VERPs from being widely exploited, even |
| 73 | though the idea is not new. |
| 74 | |
| 75 | |
| 76 | 3. Per-message VERPs |
| 77 | |
| 78 | VERPs are not restricted to distinguishing mailing list subscribers; |
| 79 | they can also be used to distinguish messages. |
| 80 | |
| 81 | For example, a user can send one message with an envelope sender |
| 82 | address of user-dsn-1, the next message with user-dsn-2, and so on. |
| 83 | As long as the local mailer gives all user-dsn-* back to that user, |
| 84 | he can reliably match up incoming bounces with outgoing messages. |
| 85 | |
| 86 | Per-message VERPs can be combined with per-recipient VERPs. Every |
| 87 | application of RFC 1891's ORCPT and ENVID can be handled with |
| 88 | VERPs---easily, reliably, and right now. |