Slashdot Mirror
Verizon Email Restrictions
CodeMonkey5 writes: "The following excerpt is from a Verizon email sent to all Verizon customers regarding the use of their SMTP servers. The gist of it is that if you are using an email address other than that of Verizon in the 'From' field, you cannot use their SMTP servers. '...If you are sending email using an email address other than one
provided by Verizon Online, this message affects you. Effective,
August 8, 2001, you will no longer be able to send email from any
email address other than the one provided by Verizon Online (this
includes privately branded domains and secondary ISP accounts).
We are taking this action as a result of our continuing efforts to
improve the quality and reliability of Verizon's mail system and is
one of several steps to help reduce spam. The effect of this change
is that Verizon Online email will no longer support sending email
from other ISP accounts or privately branded domains that are not
hosted by Verizon Online ...'"
Errr....maybe I shoulda written "offlist"...
Have you tried to contact me via carrier pigeons?
-davidu
# Hack the planet, it's important.
Actually your wrong.
Verio runs pop-before-smtp across their ENTIRE network. It is easy to setup, pop-before-smtp done properly DOES work, as does SMTP-AUTH.
-davidu
# Hack the planet, it's important.
-davidu
# Hack the planet, it's important.
No... You can block relaying by limiting based on IP address.
That blocks outside spammers, but does nothing to prevent spammers from signing up for an account and sending tons of spam from idiot@makemoneyfast.com. Typically, a spammer will have several such accounts.
All this policy does is makes sure that Verizon doesn't get used that way. It is an inconvieniance for people with legitimate reasons to use an alternate address as the from address, in much the same way that door locks and keyed ignition inconvieniance the legitimate owner of a car.
The solution is for the third party host to allow authenticated users to use their SMTP from any IP.
So, use smtp_auth. Doesn't matter where they come from - they have to validate themselves before they can send e-mail.
From someone who hosts domains.
pair.net would have the same problem. The issues isn't that they don't provide a mail relay -- it's that they don't provide a mail relay that can be used directly by Verizon customers. This completely reasonable -- otherwise (without an authentication scheme) any Verizon customer could relay spam through their server.
Obviously, there are authentication schemes that can work around this (as suggested elsewhere in this message), but they're nonstandard and a pain for both the ISP and for the customers.
This isn't really a relaying issue, though - they're just disguising it as one.
The real issue is that people are ordering Verizon, and either hosting their own domains (over DSL, with a static IP), or using other email addresses (such as domains they may have forwarding to their Verizon account, or alternate ISP accounts with better email packages/controls) - and Verizon doesn't like that.
The dream of all big consumer-oriented corporations is a huge closed-doors community, where once you're a customer, you have to do everything through them. That's what Verizon wants.
They want to guarantee that if you're a Verizon customer, that you USE your Verizon-branded email. That makes your address a "verified good" address, that they can then put on a list, along with your name, and any other personal information that you've given them, and sell to other companies.
They want to make sure that when you go for a domain for yourself, or your business, that you have NO CHOICE but to have Verizon host it - otherwise yo won't be able to take advantage of it through your existing Verizon 'net access account.
Were I a Verizon Online customer, which I'm not, I would be furious - even if this policy didn't affect me *now* - as it might in the future.
I'm very glad I went with Speakeasy for my DSL line, and not Verizon. It will be a sad day when Speakeasy implements any kind of policy like this.
As for options existing Verizon customers have - the best option would, of course, be to cancel your Verizon account, tell them the reason, and go with a competitor who has a saner policy. Barring that - is Verizon blocking SMTP sends from DSL customers running their own SMTP servers on static IPs? If not, it might not be a bad idea to pick up a cheap linux box and run Sendmail/Postfix/Exim/Qmail to handle external accounts.
adding to an addressbook.
mailing lists.
their own.
that means that people on the list who expect that hitting R will
reply to the list (because they've gotten used to the list setting
reply-to) will accidently and possibly unknowingly not send things
to the list when they want to.
I have been using the ats@acm.org address through several ISP changes
over 5 years or so and it has enabled people to find me after long
amounts of time. It only works because people will pull up old
emails of mine and see the address, and try it. No amount of telling
people what email address to use will stop short-lived addresses from
finding their way into people's addressbooks. No matter how much I
like OOL, eventually I'm going to stop using it because eventually,
I'm going to move off the island. (The odds of my wife completing her
PhD, doing two postdocs, and finding a tenured faculty position all
while sticking in this area are low, you know?)
I'm not precisely sure how ensuring a verizon return address would help
the spam issue. If it's sent through your IPs, you can track the
spam down no matter what the address. If it's not, you can't do
anything. (After all, you already refuse to relay from outside your
IPs.) It might make it slightly easier for other admins to lay blame,
but they're going to have to trace headers anyway to show that it
isn't someone relaying through uu.net and setting an verizon return
address.
I can understand blocking outgoing port 25 on your network except for your mail server and thus assuring that all mail is routed through the ISP's mail server - Mindspring/Earthlink has been doing this for quite a while! But not relaying mail for your local users (regardless of from address) breaks one of the core reasons for having LOCAL mail servers. What the hell else are people going to do? Most third partys' mail servers are locked down to allow local relay only (as well they should be!). Yeah there are a few open relays out there, but everyone won't be able to find one. I for one won't be opening up my server!
The problem with allowing random-relay from local IPs is that your customers can still spam through your mailservers while disguising their address. You can blast a lot of spam even through a 28.8 connection before you get caught.
I remember when MindSpring turned off port 25 access to the outside world -- a lot of their customers made the same complaints I'm seeing here. Turning off outbound 25 is actually a much more draconian measure than this -- it still allows legitimate access to third-party SMTP servers that allow it.
The bottom line is, this is understandable and I see it all the time.
-- Old Man Kensey
They ALREADY block outgoing Port 25 traffic
I'm on Verizon DSL, and we're not blocked on port 25 currently.
iMac: $999
OS X: Included with the iMac
Sendmail: Free
Factual Slashdot Post: Priceless
---
When in danger or in doubt, run in circles, scream and shout. --Robert A. Heinlein
Some of the early posters confused open relaying with normal SMTP behaviour and normal ISP behaviour.
For example, I have my own domain, kylecordes.com. It's hosted by an internet hosting provider. I receive email there.
My ISP for internet access is Speakeasy. I send email through them, but that email is marked *from* my email address, which is @kylecordes.com. Speakeasy does not force me to have any email I send through them marked @speakeasy.net.
Speakeasy is not an open relay; they are correctly handling outgoing SMTP only for their own customers (including me). They know it's me because I connect through their network.
Were I a Verizon customer, I would be unhappy. I don't wish to use an @verizon email address... that's why I got my own domain name.
The Verizon policy looks like a way to try to force their branding onto all of their customers' email address.
[Paying customers who are unaware of the benefits
provided by Reply-To: headers are also very annoying.]
Sending out email with a From: that lists a residential throwaway ISP mail account and only the Reply-to: lists your real, long-term, paid-for-the-domain email account, looks rather unprofessional. Some mail clients either don't handle Reply-to very well.
[hosted your domain through Verizon]
How dare I wish to:
* already have hosting arrange somewhere else and not want to switch
* want to buy a flavor of hosting that Verizon does not offer
* Have more than one ISP for whatever reason... obviously at most one can be the same place I host my domain.
* etc.
[Verizon doesn't want to be relaying mail for non-customer domains]
Indeed they don't.
It would make a lot more sense, though if they were interested in relaying mail only for their *customers* regardless of domain, rather than only for *customer domains* per se. My ISP (which is not Verizon) has the desired behaviour, for example.
[don't think this qualifies as a "Your rights online"]
Agreed. But it does seem like a customer-hostile policy.
I'm not sure exactly the legal meaning of common carrier, but it seems to me that Verison may be one. As such, to what extent does it (legally) have the right to engage in anti-competitive acts? (Of course, it may have cleared this with the government ahead of time...)
Caution: Now approaching the (technological) singularity.
I think we've pushed this "anyone can grow up to be president" thing too far.
So what is the problem? It sounds like to me that they are actually tightening up their mail servers and not allowing relaying. Isn't this the exact thing that we say all ISPs should be doing? This measure doesn't stop you from sending your own email from your own mail server.
---
His point was that you don't need to make an SMTP connection to some other mail server for sending outbound mail with your own private e-mail address. I just tested it on a mindspring dialup to be certain. It works fine.
There are two ways to send mail out with your own private e-mail address. Mindspring blocks one of them (the one most abused by spammers because it lets them do the relaying) but not the other. They may have volume throttling on their servers to keep any one IP address from sending more than some limit through at once. That would stop most spamming through their own servers.
You do need to check your attitude problem. While ckuhtz wasn't specifically addressing the point you made, he was pointing out the alternative you have for sending e-mail. You might have a preference for not using his solution, but there is no evidence whatsoever in his posting that he is ignorant about how SMTP and such work. In fact he seems rather well informed to me. Your personal flame on him was uncalled for. Lighten up. If you don't like being narrowed to using the ISP mail server for outbound mail, talk about that without flaming people. Or make the capitalist move.
now we need to go OSS in diesel cars
Hosting the domain with Verizon isn't always an option. Some people have their vanity e-mail addresses in other domains where they don't own the whole domain. For example I'm working on setting up an email forwarding system for the domain ham.org for ham radio operators. If you were a ham and wanted to use callsign @ham.org, you could receive your mail once the email address is registered, but you can't use it in the FROM: field for outbound mail as a Verizon customer. And it's not a domain you can host with them, either.
This is a perfectly valid story, given the complications it really does cause for people. Do you really want to let a company like Verizon manage your domain? I wouldn't.
now we need to go OSS in diesel cars
Most likely they will soon, if they do not already, restrict port 25 outbound to just their own servers. Earthlink/Mindspring does it, and it substantially reduced the sourcing of relayed SPAM from their network. I believe Verizon will end up doing this, too, because what they are doing now will have only minimal effect or SPAM reduction, and when people start running their own mail servers, there will be the new exposure to having relays within their network (not everyone who wants to run a mail server to host a vanity domain will be running something secure). And it won't further their marketing goals that probably prompted this particular restriction.
I understand perfectly. I don't know what Verizon literally does at a given moment (I don't get any service from them, fortunately), but I do see the ways they generally do things, and it's not good. This is only the first step, and a bad misstep, too.
now we need to go OSS in diesel cars
The problem with requiring the 'From' field to contain an address from the Verizon domain is that every spammer know how to hack a 'From' field. This now means that we will be having a lot more spam apparently originating from the 'Verizon' domain.
The better approach is to use user authentication at the e-mail server. I have come across a fair number of SMTP servers that require you to authenticate yourself, preferbly with the help of SSL, before you can send your e-mail through them. Couple this with IP verification, as Verizon should know which IP ranges they own, it make it would very difficult for a spammer to relay e-mail via their server.
Now if only more e-mail clients supported SSL.
Jumpstart the tartan drive.
I see it completely the other way around. I can understand forcing your mail server to only accept mail marked the way you want it to be (such as, from your domain)...
but an ISP forbidding connections to other SMTP servers directly from it's users? That's a crime. What if I have my own mail servers elsewhere? I'm not allowed to connect? That's right.
IT's when these two things are combined there is a real problem; to me, internet access & internet services are two totally different things; they should be sold as such. I don't want mail services from my isp... I shouldh't have to shoulder the cost of them.. I just want unrestricted forwarding of IP, and I'm willing to pay for it.
We are a small ISP and host domains and for some of the business in the area. We recently had a couple of them come to us with this problem. We don't want to install pop before smtp at this moment as we are rebuilding our datacenter. Since verizon dsl doesn't even offer static ip's to it's customers, we have 2 choices, tell the customer to use their verizon mail address and their @domainname address in the reply to field. Or us open up our mail server to accept mail from a /22.
When talking to verizon they told our customer that they should just host with them. Spam my ass.
-doon
To E-mail me, replace the first period in my domain with an @
> they can now improve service by restricting
.|` Clouds cross the black moonlight,
> service?
Sounds like it. Ever heard of `relay'ing? It's not hard. It means you send email from/to a non-local domain through a server. It's a good way to increase the amount of spam, to allow relaying....
My initial reactions are along the lines of `what's this doing here? closing down an open relay is a damned good thing!'.
PS 2+2=4. This is not rocket-science.
~Tim
--
~Tim
--
Rushing on down to the circle of the turn
Wrong.
You have a domain name hosted by XYZHostingCompany.com, but you connect to the internet from xyzISP.com. You have the domain myDomain.com and the email address me@myDomain.com.
Yep, and if I connect to the internet through xyzISP.com, they can confirm that I am a legitimate customer, since they gave me the IP address. This is not relaying! The From: address has nothing to do with stopping relaying.
XYZHostingCompany.com has a special relaying server setup for its clients at relay.XYZHostingCompany.com
Many hosting companies don't have a special relaying server. Besides, doesn't this mean that a spammer with forged From: address has just found an open-relay server?
xyzISP.com SHOULD NOT be letting you send mail as me@myDomain.com because they don't have anything to do with that domain, if they let that domain through, they would basically be letting everything through, which means they would be used to send lots and lots of SPAM (which would, of course, degrade the level of service for their valid clients).
This is BS. The ISP assigns the IP address to their customers, and don't allow anyone from an invalid IP address to connect to their SMTP servers. They don't have to rely on the domain of the From: field to stop relaying...
If this were to stop using their SMTP servers when you are not connected to the internet through Verizon Online, then this will be indeed OK. However, it sounds like even if you are dialed into the Verizon system, or connected via DSL, they are trying to prevent you from using their SMTP server, only because you are using an e-mail address from a domain not hosted by Verizon.
Usually an SMTP server is provided by your ISP, since you are part of their network when you are connected to their service, and they can contlrol who uses the SMTP servers based on IP address. POP and IMAP servers can be provided from any place. If you have your own domain, the hosting provider usually provides a pop server, so that you can have e-mail going to your domain.
There is no technical reason behind this decision, only an attempt to force the Verizon customers to host their domains with Verizon.
I geuss I'll have to use the secret Reply-to: header.
The problem is that ORIGINALLY (back in late June when I sumbitted this story and it was rejected) they were saying that your Reply-To: also had to point to a Verizon domain! They have since clarified that this is NOT so, but by then, I had changed over to Roadrunner, so who cares
-- 73 de KG2V For the Children - RKBA! "You are what you do when it counts" - the Masso
I've been a Verizon customer since 8/96 and I barely ever use their DNS, SMTP, or POP3 servers. Yes, I'm a horrible netizen, in that my Linux firewall uses world root DNS servers, and updates the list once a month with 'dig'. I alternate my diald between prodigy and verizon sessions.
If you are using more than one ISP then use of ISP servers complicates things for you anyway. Since you need to mess around changing things and restarting services in ip-up/ip-down
You are telling me Verizon doesn't know their customer's IP address when they connect to the SMTP server, or if they know it, that Verizon cannot enforce their AUP based on that information?
How large a company are they also have they grown by buying up other ISP's...
They cannot detect an IP address sending hundreds of e-mails per second?
You could even do this automatically. An IP address with is only opening TCP connections to port 25 is rather obvious.
Simple solution - your university should have an SMTP-AUTH relay available.
Probably even more to blame are those people who write software with the requirement for a third party relay. When this was never actually part of the spec in the first place.
Even though there have been recent revisions the basics of RFC974 still stand. Yet too many people treat using third party relays as though it is the canonical way to do things.
another "anti-spam" trick ISPs have been using is to block outbound requests on port 25. This prevents their customers from using outside SMTP servers (and really causes a hassle for us web hosting companies trying to figure out why people can't send mail with their account's servers...)
As well as messing up anything which does follow the published specifications (and dosn't need a third party relay in the first place.)
Do you think enough people would drop an ISP who did this to make it a really bad idea, or do some of these ISPs have enough mindless zombies as clients that they could get away with it?
In the case of home win9X machines on dialups it isn't likely to even be an issue... Or maybe that an synonym for "mindless zombies".
Same holds true for my Cayman Islands mailbox. Both do not have open relays as they are supposed to, so I can't sent mail with their servers
No absolutly nobody should be providing open relays. Indeed if you read RFC 2821 you will not even find the kind of restricted third party relays advocated.
There is only one canonical way to be sending SMTP email.
Problem is some people though they knew better and created programs which require third party relays to operate at all.
Blocking outgoing smtp to other non verizon smtp servers is acceptable, forcing email to go through their servers. That will allow verizon to have a log of all outgoing port 25 email from their network.
Except that port blocking and transparent proxying is the hard way to do things if all you want is a log of connections to TCP port 25.
tcpdump will do this...
Nope, it's the fault of whoever invented SMTP. It's such a stupid system, as far as protecting against spam
Actually this is a consquence of software which demands third party relays. Something which is outside the spec in thr first place. If RFC 2821 were actually followed then it would be considerably harder for spammers...
Also, I you CC a lot you'll be wasting bandwitch since your mail server has to connect to all the people who you send the mail
How many legitimate emails do you think this applies to? Also the people who'd be most inconvenienced by not being able to use a third party relay as an expander are spammers
These are not an open mail relays. Only verizon customers can acess the verizon mail relays.
Some ISP provided third party relays are only one step removed from open relays. The critical factor is if the ISP has procedures in place to verify the customer is who they claim to be before they are allowed access...
--
I host a POP server for some folks who send e-mail over dialup link with a "From" address of their domain for which I MX.
I could give a flying fuck what their customer support says, and I've never called them for anything, ever. Earthlink is handling this stuff in a reasonable way that limits the work they have to do to squash SPAM while keeping options mostly acceptable for their customers. Check you facts against reality before you go insulting people, asswipe.
Boss of nothin. Big deal.
Son, go get daddy's hard plastic eyes.
Expanding a vast wasteland since 1996.
But if what you're saying is correct, then Verizon's new policy could be stated as "Run your own mail server, or use our email addresses", which sucks for many customers, to be sure. Especially if their static DSL IPs are on the DUL, which would be surprising and stupid. But otherwise, it is a fair and freer approach to Earthlink's "block port 25" solution. For one thing, it won't leave you wondering if the word "Scientology" gets a copy of your email forwarded to a windowless building somewhere.
But if what you're saying is incorrect, then I will NEVER buy DSL from Verizon, and I wouldn't use it if it were free.
Boss of nothin. Big deal.
Son, go get daddy's hard plastic eyes.
Expanding a vast wasteland since 1996.
That's the point. They ALREADY block outgoing Port 25 traffic so, yes, that is why this is such a big deal.
No they don't. I'm a Verizon user in Pennsylvania and I can connect on port 25 to any SMTP server on the net that will allow me to. I'm not an Earthlink customer, but several posts above indicate that Earthlink blocks all outbound port 25 connections to all servers except for their own outbound SMTP servers. Your high-port solution applies to Earthlink users.
I've been a Verizon customer since 8/96 and I barely ever use their DNS, SMTP, or POP3 servers. Yes, I'm a horrible netizen, in that my Linux firewall uses world root DNS servers, and updates the list once a month with 'dig'. I alternate my diald between prodigy and verizon sessions. Work pays for my unlimited Prodigy account, but it disconnects after 7 hours of connect time, and Verizon limits monthly usage to 150 hours. So I leave diald on Verizon for normal surfing periods, but switch over to Prodigy when I'm doing multi-day, restartable downloads.
I personally agree with this policy. If you still want to spam you can, but you can't tie up their SMTP servers. If you want to forge an alternate, legitimate From: address, you still can, too, with a little more work. I'm not sure if I think hosting companies should offer this same type of restricted service for their own hosted domains (without SMTP-AUTH or POP-before-SMTP), because I understand that it forces spammers to select valid 'From' domains, thereby releasing wrath of spam fighthers upon already over-worked sysadmins.
So far, it seems POP-before-SMTP or that XTND XMIT feature are best to me.
--
Steve Jackson
Intelligent Life on Earth
I don't get it.. an ISP says if you want to send mail through us, it has to be mail FROM us, and this is somehow construed as restricting our rights?
If it was the only ISP in town, maybe, but as it is, I don't see the big deal. It's not like my normal web-mail services don't have provision for sending something directly from them.
A pain? Sure. But lets reserve our energies for the real battles.
That Jesus Christ guy is getting some terrible lag... it took him 3 days to respawn! -NJ CoolBreeze
I assume you mean they can't block all the high ports. Blocking a few, e.g. Xindows' favorite ports, has little noticable effect. Note that there isn't any really valid reason to block other ports even if they somehow detect SMTP traffic to them, because spammers aren't going to be using them - said spammers won't be scanning high ports for open relays, and anyone with enough technical cluefulness to set this up probably isn't going to leave their mail server open anyway.
If you really want to give a spiteful IP that just wants to force you to both use their email domain in addresses and use only their servers, put your external SMTP server on port 80. Or 880, et cetra.
BellSouth requires the domain you use in the from field to resolve to a valid domain, which seems to be a much better solution than just requiring you to use their domain.
That just means the spammers will have to masquerade as a VALID domain - and some poor sysop who DIDN'T have anything to do with the spam will catch hell.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
As a Verizon victim...err, customer, this would affect me as well. Except I stopped using their SMTP server when it started choking on my outgoing mail (hanging in the middle of DATA).
And though I've never used my bellatlantic.net address ever, it somehow manages to receive about ten pieces of spam each day, starting with the very first day my DSL went live.
Then there's the news swerver, which fell down and went boom a couple of weeks ago (collateral damage from the Hipcrime floods?). Instead of rebuilding the spool, they just started from scratch.
Their Tier 2 techs are pretty clueful, but Tier 1 tech support is staffed by some human-fish hybrid.
k.
--
"In spite of everything, I still believe that people
are really good at heart." - Anne Frank
"In spite of everything, I still believe that people are really good at heart." - Anne Frank
Sounds like an attempt to increase hosting revenues to me. I imagine a lot of people use Verizon for their ISP but host their domains elsewhere as the major ISP's hosting prices are usually on the high side. Of course, if you own your domain name - what ISP you are using is transparent more or less so I would think changing ISP's will be easier than moving your domain to Verizon.
These are not an open mail relays. Only verizon customers can acess the verizon mail relays. Just because verizon customers can send emails that purport to be from a non-local domain to a non-local domain does not make them open relays.
Again, even with this policy I can just as easily spam you with a nobody@verizon.net and it would be just as easy or hard for verizon to track me down if i used nobody@nobody.net
I am tired of corporations changing the rules of the game half-way through. I and many other college students in Boston use DSL and also use our @youruniversity.edu addresses. Because most universities do not have SMTP-AUTH servers - this would effectively prevent us from using our @edu addresses. This will not "reduce spam" and it will not make their "email" more reliable. Tell me how forcing me to use Verizon's email servers rather than ones of my own choosing is more reliable. This combined with the fact that Verizon can't operate any IP services reliably (in my experience) makes it seem even more asinine. This will not reduce spam as I can spam you just as easily through the Verizon smtp with nobody@nowhere.com as I can with nobody@verizon.net. Both are equally difficult or easy to trace to the origin "spamming" customer.
The reasons Verizon provides for doing this are a farce. I am sure the real reasons such as increased customer retention when locked into an email address, increased exposure to email recipients of the verizon.net domain name, etc. are the _real_ reasons for this corporate act of oppression.
This is incredibly short sighted and probably actually contributes more spam than it stops. If current Verizon customers want to be able to send mail with a non Verizon return address they must get their return email host to open up relaying for Verizon IP's. In this scenario, it wouldn't take very long for spammers to start sending their bulk mail from Verizon IP's because of an increased likelyhook of finding open relays.
In short, by Verizon doing this they may have inadvertantly created an island haven for spammers to circumvent current anti-spam mechanisms.
Not only that, it completely defeats the purpose of having a local mail relay in the first place. Verizon customers who can't send mail the way they want will start running their own smtp servers, which will probably be misconfigured, once again creating more opportunity for spammers. WinSMPT anyone?
Finally, it seems like a rather Draconian policy to force all of your ISP customers to use your service for email. What's next? Are they going to start advertising in the emails? Compiling information on their customer base?
This is just wrong in so many ways.
Sigs are awesome huh?
--
--
E2 IN2 IE?
Client support is primarily in Eudora- the option to enable this feature is tricky to find in the free Eudora client- in eudora.ini, set 'UsePOPSend=1'.
I do not deploy Linux. Ever.
It prevents forgery, but also prevents users from using other legitimate email addresses as the sender- since there is no way for Verizon to know an address is legitimate, except for the one address they've assigned to the customer.
There's another tactic that some ISPs are using to prevent spamming- blocking or redirecting end-user connections to any port 25 at any remote host except for the ISPs own mail servers. If Verizon were to combine their anti-forgery rule with a 'you must use our mail hosts' rule, that would be a serious inconvenience to legitimate users.
There is a solution.
If you absolutely must send mail with the 'From' being a domain other than your ISP, see if the actual owner of the domain will set up a POPmail server with 'XTEND XMIT' support, allowing you to send out your mail from an authenticated POP session. Note that this is entirely different from the 'pre-authenticating SMTP relay access' technique that was found to be buggy recently.
I do not deploy Linux. Ever.
Do you have any references for XTEND XMIT, or an explanation of the bugs in pre-authenticating SMTP? A google search I just ran didn't turn up very much.
TomatoMan
-- http://frobnosticate.com
For the students who are suffering because they can no longer claim to be @foobar.edu when sending through @verizon.net, may I suggest a quick look at RFC2822? Mail programs don't respond to the "From" address, they respond to the "Reply-To" address.
The early bird gets the worm, but the second mouse gets the cheese.
My university decided they wanted to stop spam, so they restricted smtp to accounts within their local network. If you're not on campus, or on the handful of dialup accounts, you can not use their server to send email. But, they say, you can use your ISP to send email! Just set your from address to your university address, and no one you're writing to will know the difference. However, that won't work now thanks to Verizona's new policy.
Is this entirely Verizon's fault? No. Is this entirely my university's fault? No. But who gets hurt? The users. In both cases, the person paying for the service. Yes, there are ways around it, but not ways the average user will know or should have to go to the trouble of.
So, do not simply think this is a non-issue.
Google doesn't index user sigs, so stop trying to "Google Bomb" with them.
Let me give you a perfectly legitimate example of why this is bad. Let's say that I have my own personal account with a smaller ISP without national dialup. I also have my corporate email, again without national dialup. Now, both of these SMTP servers have limitations on them such that you can not send email through them unless you are using an IP that is on their network. This is a perfectly reasonable relay-limiting technique. Now, I also travel a lot so I've got to have some kind of national dialup so that I can send and receive both corporate and personal email. Because of the aforementioned anti-relay technique (currently in use by most ISP's), I would only be able to send through my dialup providers SMTP server. Now Verizon is saying that even though I am paying for an national dialup account, with use of their SMTP servers, I can no longer use it for one of the most popular reasons [business] people get national dialup accounts. I really don't think this will fly in the long run because those users will either put up a stink or move somewhere else. It's unduly limiting and won't really prevent what they want to prevent. The spammers will start using @verizon.com in the From: field and use a Reply-To: or put it in the body of the message.
Omeganon
It might seem okay for them to make whatever restrictions they like for their SMTP servers, but unless they're willing to sell a nailed-up connection with a static ip for a reasonable price, it's not practical for their customers to run their own servers.
Granted, it's somewhat better than blocking port 25, as earthlink does, but it still sucks.
It's getting so that you can't do anything on the net (other than browse the web and exchange email using your assigned address) without getting your ISP's permission.
As bad as SPAM is, it doesn't justify having content police for the Internet. What's next - active monitoring of IP packets for copyrighted material?
If you were a customer of Verizon and hosted your domain through Verizon then you would be able to send and receive e-mail to your domain.
Verizon doesn't want to be relaying mail for non-customer domains. Meaning, if I host slashdotsucks.com with Verizion, I can send and receive e-mail from timothy.should.not.post@slashdotsucks.com. However, if I was a Verizon customer, but hosted slashdotsucks.com with another company they would not allow me to send e-mail from timothy.should.not.post@slashdotsucks.com through their servers.
I thought this was standard configuration anyway. I am a Verizon Online subscriber but I use my e-mail services through work.
I don't think this qualifies as a "Your rights online" type of thing, it probably should have been rejected.
I just realized I'm going to receive negative moderation points for saying slashdotsucks.com. Slashdot doesn't suck, this is an unusually terrible story and it is something which really didn't need to be posted. Perhaps timothy should join JonKatz on my Blocked Editors list. I've already got SlashBack blocked.
The List of Grievances with Slashdot.
Because 90% of the SMTP mail that doesn't relay through the ISP mail server is spam?
I bet the same percentage of traffic through verizon's relay which does not have a from of verizon.com is a forgery.
Personally, 100% of the SMTP mail I send out does not relay through verizon.com, and is not spam. I know that doesn't disprove your 90% figure, but I would be personally affected by a port blocking measure and would seriously oppose it.
Mail from adomain.com should go through the SMTP server of adomain.com, since only that server has any ability to check the validity of that address. Actually, I'm not convinced that there aren't SMTP servers that enforce this restriction. Blocking 25 would not let you send mail to those systems from your vanity domain.
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
Wow, then i couldn't send out ANY mail from a domain i manage, since our hosting provider doesn't do SMTP from customers (they just accept incoming mail to the domain and either POP3 or forward it) and we don't have the cash to get a mail machine somewhere.
Well, yes, I think this is the way it should work. If we were to design a protocol from scatch, surely that would be how we would do it. Hosting providers like yours would simply not be allowed. Due to historical reasons, we have to accept that some people will be in your situation though.
If only the ISPs would just go after the spammers, instead of treating us all like criminals... What if the USPS would refuse to accept your mail unless you put your current address on it, as opposed to your P.O. Box, or your work address, or your friend's address when she's over at your house and needs to send a letter, etc.? But most people are too clueless about the Internet to care, or are too blinded by the "Spam is evil! Death to spam at all costs!" mantra to notice...
I completely agree with you on this point. It should be the responsibility of the mail recipient to set the rules. It is simple enough to simply refuse mail which is sent with a from an address which does not match the relay server. It is completely trivial to block 99.9999% of unsolicited email. Simply block all email which is not using a From: address from which you have solicited email. But this of course is not what people want. People want to allow unsolicited email, but not unsolicited commercial email. Well, short of AI, you just ain't gonna get that. So you better settle for blacklists.
ok then your [sic] infringing on my copyright! Could you as [sic] me next time before STEALING my comments for your own?
Use your domain address in the reply-to address to get around the FROM issue. Domains that are hosted with Earthlink, or that customers have e-mail addresses through Earthlink with are exempt from this, they are considered valid FROM addresses examples: mac.com
Set your SMTP server to listen on a different port.
These were turned on to defeat the typical script kiddie, and because as part of the settlement Earthlink agreed to implement end-to-end accountability for when users spam. It isn't about the resources of the mail server, although it is cloaked in that by many.
The problem is spammers used to simply use the incorrect FROM field to try and hide. That is easy to stop because with the ISP headers on the e-mail it is easy to track down the spammer and cancel their account. SMTP auth is set up.
Next step spammers took was to sign up with DSL with one provider and use open relay SMTP servers all day. Yes, you can run around swatting open relays all day and get nowhere to stop spammers. So MAPS or ORBS went after Earthlink to set up some accountability for people connecting with them and then using open relays.
While I dislike port 25 blocking it is here to stay. Yes, spam is bad, but fighting it should not inconvenience the average user, or legitimate business use. Mindspring had it for about year before they merged with Earthlink.
There is one exception to Port 25 blocking on that network. Customers with static IP IDSL, SDSL, Frame and Point to Point, since many of them host their own mail servers and are responsible for their own actions.
Another thing that is used as a simple measure to prevent incoming spam is only accepting mail from hosts which meet the following criteria: - You can reverse look up the IP - The resulting name is listed in the mx for the record they reverse as.
Although in principal I'm all for reducing spam, refusing paying customers the ability to send mail that is returnable to the account they choose would be very annoying. Most people don't like to use their ISP provided email addr because if people come to know them by that addr, [store it in their address book, rolodex, etc], then the customer is more locked into not switching ISP's because they would then lose that address.
They are their own servers and all, they can provide whatever level and type of, cough, service, they want to. If I was using verizon I would consider strongly switching ISP's right away.
Also, there is the question of whether or not it is really necessary to use them as a mail gateway. One can always run one's own invocation of sendmail, and it would happily squirt off mail with any return address you wanted. That is, unless they have transparently proxied port 25, and put this additional restriction on it. Course, that wouldn't be so transparent a proxy anymore, would it.
I'll have to wait until I know more, but I really don't like any additional restrictions on use. Besides, spam really isn't much of a problem to me anyway. Just use seperate addresses for different classes of mail. Keep the spam coming to one or two, and have others for private and personal contacts.
---
---
the pen is mightier then the sword. the sword is mightier then the court. the court is mightier then the pen.
This actually forces users to violate RFC 822, the mail format standard: The From header field must contain the author or authors of the message, not the actual sender.
So whenever a Verizon user wants to send a message that was not written by her or him, he is forced to violate RFC 822.
The correct solution would be to force a valid account in the From or Sender field (but maybe that's what Verizon ios doing anyway).
Claus
In many cases, this isn't a viable option. The IP addresses assigned by cable and DSL providers tend to be listed on the MAPS dialup list. Refusing to accept mail from machines on that list is, in my opinion, one of the safer and more conservative anti-spam measures that a number of hosts have instituted.
At my second job, we've got business DSL and a static IP address (which isn't listed on the MAPS DUL). However, we still have to relay outgoing mail through our provider's mailserver because of one rather prominent national ISP (Hint: "You've got mail") that chooses to silently discard messages that we attempt to send directly to their mail server. We mailed their postmaster about this, but never got a reply.
If our DSL provider were to do the same thing as Verizon, it would be entirely unacceptable. We're trying to run a business here, and we want the added professional look of From addresses that end in @(ourcompanyname).com.
Telefónica, the Spanish almost-monopolistic telecom company, began to do this some months ago, and the only problems that arose were that THEY DID NOT WARN THE USERS BEFORE. The "end" users, the ones with modem connection and two-emails-a-day, had no problem. The e-mail-junkies (like me) and the heavily-Internet-dependant companies (like the one I work for) simply set up their own Linux SMTP servers in their old, already-replaced, no-longer-usable-for-desktop 486 (or, if they use Linux in their desktops, as it is my case at home, just set up an SMTP server which I fire up only when I need it, to save RAM).
Bottom line: NO PROBLEMO.
Strength, balance, courage and reason. If you know what's this about, contact me!
However, the point to remember is that either of these approaches works. It's only if Verizon does BOTH that there will be a problem.
This next song is very sad. Please clap along. -- Robin Zander
My wife is a student living at home (offcampus). We point a mail profile to the school POP. This would kill reading and replying to mail from the school mailbox. Same holds true for my Cayman Islands mailbox. Both do not have open relays as they are supposed to, so I can't sent mail with their servers. What good is getting mail that you can't reply to using the proper address? I don't want to go to the school just to reply to school mail, or worse, the Cayman Islands just to reply to mail. I don't want to give everyone at the school my local ISP mailbox. I'm keeping it spam free. The school account will close at the end of the year and all the varsity signup stuff will go away with it! With that restriction, I can't use Verison as a ISP. That kills one quarter of the usefullness. The reply to addresses in my mail are valid.
The truth shall set you free!
Sorry for the unclear wording... I tried to say they have it right by being closed, which is the way it belongs.
The truth shall set you free!
I can understand blocking outgoing port 25 on your network except for your mail server and thus assuring that all mail is routed through the ISP's mail server - Mindspring/Earthlink has been doing this for quite a while! But not relaying mail for your local users (regardless of from address) breaks one of the core reasons for having LOCAL mail servers. What the hell else are people going to do? Most third partys' mail servers are locked down to allow local relay only (as well they should be!). Yeah there are a few open relays out there, but everyone won't be able to find one. I for one won't be opening up my server!
Here's what I see happening:
This will actually increase Verizon Online's network's contribution to spam...
- Verizon blocks their users from using their mail servers for foo@bar.com accounts
- Many of the more savvy users start their own mail servers on verizon's network to act as a local relay.
- Some of these people aren't going to be savvy enough and some of these servers will not be configured correctly such that they are open relays (not hard AT ALL to do)
- Some spammers find these open relays
- Verizon's network is now contributing to the spam
Basically, what this tells me is that they are too lazy to police their own users by dealing with spammers when they occur and instead have opted to just say "It isn't us! We're secured!"quis custodiet ipsos custodes - Juvenal
But, in the end, the servers ARE theirs. If they don't want to share, or if they want to limit thier customers abilities, we can do thing the Capitalist way. Not buy thier service, and use other smtp servers. I've had RoadRunner for over a year now, and haven't even setup my *@rr.com accounts. I use thier DNS, but that's it. Perhaps I don't fully understand the implication of Verizon (Sprint) doing this, but I don't really see how it will amount to a hill of beans.
- Dan I.
You obviously have never run a small business. Small business owners want their business to appear biger and more professional to be attractive to customers. Sending email from address X reply to address Y appears amateurish and presents them as technically challenged. Small companies need Internet access and sometimes Verizon is the only game in town. You used to be able to host email at a web hosting company till ISPs started blocking ALL outgoing SMTP traffic. So much for that. So folks found they could send using their ISP server while still using their domain in their email. Now Verizon is blocking that. Its sad and in teh end will only hurt Verizon.
I'm lcuky enough to have an ISP that doesn't pull hair-brained schemes like this - but they are small and understand who their customers are. However, one company I host email for found that their ISP started blocking outgoing port 25 - they couldn't use our server anymore - till we just redirected a high port (like 3000 or something) to port 25 on their email server - they updated their clients and it works fine - ISPs can't block ports > 1024 without causing major disruptions in client traffic.
So now those of us hosting small (and even large) ISPs/hosting companies are faced with not just fighting spammers, but fighting brain-dead ISPs who would rather impact their customers in the name of blocking spam. Problem is there is ALWAYS a work around!
The bottom line is, if you are faced with this problem and can find someone else with an email server - see if they can either redirect a high port to port 25 on their firewall or on the mail server itself.
Top Most Bizarre/Disturbing Error Messages
Problem is you CAN'T DO THIS with Verizon since they block ALL outgoing SMTP traffic except traffic FROM their email servers. Thus, your client CANNOT use a secondary email server to send email - the traffic is blocked - plain and simple. Thus this decision means you MUST send email from verizon's domain or not at all unless you use a web based client to send email directly from your secondary ISP's servers OR find an ISP willing to redirect a higher port > 1024 to port 25 on their mail server to get around the Port 25 traffic blocks.
Top Most Bizarre/Disturbing Error Messages
Most people who have "outside" domains will also have outside SMTP mail servers to use. Only those people with those forwarding address services, etc. will really be affected. I almost never use my ISP's email service anyway... ;)
There is an interesting potential issue here, however...lately, another "anti-spam" trick ISPs have been using is to block outbound requests on port 25. This prevents their customers from using outside SMTP servers (and really causes a hassle for us web hosting companies trying to figure out why people can't send mail with their account's servers...). You have to wonder if an ISP will ever try to implement both the From: field restriction and the blocking of port 25, all in the name of "preventing spam..." Perhaps this could be a way for ISPs to more effectively enforce those stupid TOS clauses about not using your Internet connection for business purposes? Do you think enough people would drop an ISP who did this to make it a really bad idea, or do some of these ISPs have enough mindless zombies as clients that they could get away with it? I can't see it working, because there are too many people out there now who do have mail at their own web sites or from other services, but you never know...you wouldn't think so many people would put up with the crap that AOL throws at it's users, but they're still the biggest "sort-of-ISP" out there...
DennyK
The counterbalance to a billion dollar company with excellent internal communications is not an individual consumer that makes anonymous choices, it's millions of consumers with a collective interest. And that's why it is important for consumers and customers to get in touch over the Internet and share ideas, like, in a little way, is happening here. You see, that's the Capitalist way.
If you have a secondary email account (I have 6 from 4 different ISP's) then you should set up your secondary accounts to use the correct servers. This is what we have black-listing for (to stop third party relays). All mail servers I host not only block relays, but also reject messages where the From: domain doesn't properly resolve with reverse DNS. The affect is that we have less than 1 spam on our servers a day, out of about 750,000 mails a day. We also block the "From:" address (Forging a root email or admin email) except on the administrative system (not only IP checking, but because they are on the same segment it checks the MAC address against the static MAC table). I think Verizon is FINALLY doing something right, and their customers should email them and thank the sys admin who finally got through some middle management's thick skull to implement standard blocking. Congrats to Verizon! Good work in NOT getting black-listed for relaying. (Had they not done this, and been black-listed, would there be an article on slashdot about the evils of a company that allows third-party relays?)
They want your spam at: uce@ftc.gov
Don't mess with the Feds. Now if only they had a place to report pop-up ads...
1st.net blocks ALL SMTP traffic. Not just to keep people from other networks from using their SMTP servers, but to keep their own customers from using outside SMTP servers. It shouldn't be to long now till someone does both of these things to completely prevent people from using other email address while connected to them.
My Hello World is 512 bytes. But it's also a valid Fat12 boot sector, Fat12 file reader, and Pmode routine.
I am on Verizon's network and have never used their SMTP server, so this isn't a big deal. I think requiring their own From: address is a Good Thing(tm) overall. I would also support an action to block outgoing connections to port 25 if it meant less spam being released into the wild.
I currently run a mail server on my home network that I use for outgoing mail. The only downside is that mail (very rarely) gets rejected because my IP is on a list of known "dialup" IP addresses and mail servers that check against that list reject mail from them. I've only had that happen once.
Seems to me anyone could tunnel SMTP over SSH to an SMTP server that is outside their network. Why would that be so hard? And it wouldn't require any auth because to the remote it should appear to be coming from @localhost. Plus, at least for the first hop, the traffic is encrypted.
Granted I've never set that up, but it seems like an easy solution.