From: mls@slac.stanford.edu (Mike Sullenberger (415) 926-2294)
Newsgroups: vmsnet.mail.pmdf
Subject: Problem with NETFIND program.
Date: 26 Aug 92 19:15:00 GMT
Organization: The Internet
Return-Path: <epmdf@YMIR.CLAREMONT.EDU>
Resent-Date: 26 Aug 1992 12:15 -0700 (PDT)
Resent-From: epmdf@YMIR.CLAREMONT.EDU
Errors-To: epmdf@YMIR.CLAREMONT.EDU
Resent-Message-ID: <01GO1CHXUNAA95OBJA@YMIR.CLAREMONT.EDU>
X-Vms-To: in%"info-multinet@tgv.com,info-pmdf@ymir.claremont.edu"
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-Transfer-Encoding: 7BIT

Are people aware of the NETFIND program and the problems that it can cause?

I am sending this to these lists because it took me well over a week to track
down why people all over the world were suddenly sending mail directly to one of
my nameservers for people that have never been at my site.  I thought maybe
others have seen this problem and are wondering what is going on.

Note: The SMTP that is running on SERV01.SLAC.STANFORD.EDU is the MultiNet V3.0D
      SMTP straight off of the tape.

Following is the copy of correspondance with a writer of NETFIND.

Mike Sullenberger
SLAC Postmaster

--------------------------------------------------------------------------------
 Date: Tue, 25 Aug 1992 19:12 PDT
 From: "Mike Sullenberger (415) 926-2294" <mls@slac.stanford.edu>
 Subject: BIG complaint about NETFIND
 To: schwartz@cs.colorado.edu

I am the Stanford Linear Accelerator Center Postmaster and I have a very large
complaint about your NETFIND program.  For the last week I have been receiving
mail for people that are not at SLAC.STANFORD.EDU routed to my Domain Nameserver
node SERV01.  This particular node does NOT have user accounts, and provides NO
services other then Domain Nameservice.  I have learned that people are using
E-mail address that point to my Nameserver because NETFIND erroneously claims
that mail for anybody in a search of STANFORD EDU gets mail forwarded to
<user>@SERV01.SLAC.STANFORD.EDU.

Following is an example of using GOPHER to gain access to NETFIND and then using
NETFIND to search for a person that I think might be at STANFORD EDU.  As you
can see a normal search using NETFIND produces the completely incorrect
information.

MAIL IS FORWARDED TO foobar@serv01.slac.stanford.edu

This message implies that I can send E-mail to a person FOOBAR at
FOOBAR@SERV01.SLAC.STANFORD.EDU and that person will receive the mail.  I do not
know what search criteria NETFIND uses, but DOMAIN Nameservers have NOTHING to
do with E-MAIL.  I am sure that a lot of other Postmasters and Nameserver
Managers are not going to be pleased with this situation.

Mike Sullenberger
SLAC Postmaster


------- Example ------

            Internet Gopher v0.6 Copyright 1991 Univ. of Minnesota
                                Root Directory

         1.  CAP.DIR/
         2.  FTP Searches/
         3.  Fun & Games/
         4.  Gopher Root 1/
         5.  Information About Gopher/
         6.  Libraries/
         7.  Mailing Lists/
         8.  News/
         9.  OTHER.DIR/
         10. Other Gopher and Information Servers/
   -->   11. Phone Books/
         12. UofM Campus Information/

            Internet Gopher v0.6 Copyright 1991 Univ. of Minnesota
                                 Phone Books

         1.  University of Arizona <CSO>
   -->   2.  Internet-wide e-mail address searches/
         3.  WHOIS Searches/

            Internet Gopher v0.6 Copyright 1991 Univ. of Minnesota
                    Internet-wide e-mail address searches

   -->   1.  Netfind search for Internet e-mail addresses <TEL>
         2.  Netfind search for Internet e-mail addresses overview.

                Warning!!!!!, you are about to leave the Internet
                Gopher program and connect to another host.
                If you get stuck, press the control key and the ^
                key, and then type q or c.


                Now connecting to mudhoney.micro.umn.edu
                Use the account name "netfind" to log in

                Press return to connect:

Trying... Connected to MUDHONEY.MICRO.UMN.EDU, a SUN running UNIX.

SunOS UNIX (mudhoney)

login: netfind

Welcome to the University of Minnesota Netfind server.

Search/Quit/Help [s/q/h]: s
Enter person and keys (blank to exit) --> foobar stanford edu

There are too many domains in the list.
Please select at most 3 of the following:
       0. cs.stanford.edu (computer science department, stanford university, c)
       1. daedalus.stanford.edu (stanford university, california)
       2. leland.stanford.edu (dsg, stanford university, california)
       3. neon.stanford.edu (computer science department, stanford university,)
       4. portia.stanford.edu (stanford university, california)
       5. slac.stanford.edu (stanford university, california)
       6. stanford.edu (stanford university, california)
Enter selection (e.g., 3 1 2) --> 4 5 6
NOTE:   The domain 'portia.stanford.edu' does not run its own name servers.
        Often this indicates the domain is not on the Internet, in which
        case Netfind cannot locate people there.  (Continuing search.)

MAIL IS FORWARDED TO foobar@serv01.slac.stanford.edu
------

Search of domains completed. Proceeding to search of hosts.
------
Search/Quit/Help [s/q/h]: q

--------------------------------------------------------------------------------

Date: Tue, 25 Aug 1992 21:43:31 -0600
From: Mike Schwartz <schwartz@latour.cs.colorado.edu>
Subject: RE:  BIG complaint about NETFINDMike,
To: mls@SLAC.STANFORD.EDU

I'm sorry this has caused you trouble. However, the problem is with your
mailer, not Netfind.  Your SMTP server answers EXPN requests
incorrectly.  Try this:

{latour:~ 981} telnet serv01.slac.stanford.edu 25
Trying 134.79.16.9 ...
Connected to serv01.slac.stanford.edu.
Escape character is '^]'.
220 SERV01.SLAC.STANFORD.EDU TGV/MultiNet SMTP service ready.
EXPN anyjunk
250 <anyjunk>

------------------------------------------

I would guess this is true for one of two reasons:
        1.  Your configuration is incorrect
        2.  Your configuration is set up to hide information, to preserve
            privacy (I have seen this with several commercial Internet
            service providers, for example)

If (2), I suggest you change your configuration so that it simply
refuses to answer these queries.  As it is, your configuration doesn't
conform to the RFC 821 specification.
 - Mike

--------------------------------------------------------------------------------

Date: Wed, 26 Aug 1992 10:13 PDT
From: "Mike Sullenberger (415) 926-2294" <mls@slac.stanford.edu>
Subject: Re:  BIG complaint about NETFIND
To: schwartz@latour.cs.colorado.edu

Your comments are noted, but I still feel that NETFIND is giving back misleading
information.  Being Postmaster I have used SMTP EXPN to try to track down mail
problems and I have found it to be highly unreliable there are a lot of nodes
out there that answer SMTP EXPN xxxxxx with 250 <xxxxxx>, and therefore I don't
think that you should rely on it.  Just because a node is a nameserver, does NOT
mean that you should be doing SMTP queries to it. You could at least check the
nameservice for a particular node to see if it has a WKS entry for SMTP service.
You might also look for MX records, SERV01.SLAC.STANFORD.EDU never receives SMTP
mail directly.