Slashdot Mirror
Major ISPs Publish Anti-Spam Best Practices
wayne writes "The ASTA, an alliance of major ISPs, has just published a set of best practices to help fight spam. The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast. The recommendations include such things as limiting port 25 use, rate limiting email, closing redirectors and open relays, and detecting zombies. For details, see the ASTA Statement of Intent (pdf) or any of the ISP's antispam websites."
Several large ISPs are backing SPF. I even noticed my ISP, Verizon, who tend to be quite lazy and stupid when it comes to spam (and other things), have added an SPF record.
...but the people that would really read these things are the one that know how to avoid most spam already, aren't they? I doubt my parents would even stumble across any of these resources in their daily submitting of their email addresses to every form they can find.
Spammers are like a retrovirus. The will adapt to any system you construct. Creating a list of what every major isp will do to combat them will only serve to accelerate their evolution and make them more effective spammers.
Well.. maybe. Or Maybe not. But Definitely not sort of.
I hope they find the right balance between just providing the internet and locking it down so it can't harm the average consumer.
I am thinking about setting up my own personal mail server for my small business.
Is there a guideline that can help me figure out what steps I need to take to harden my mail server?
I will be using either Postfix or Microsoft Exchange.
As long as i still can run my own smtp server.
They can limit outbound port 25 because i still can forward my email through their official smtp server. If they limit inbound port 25, it will suck big time.
How many of those ISPs were caught in pink contracts?
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
And I'm undecided as to whether that is good or bad. Sure, there have been a few new exciting tools out there- but as soon as they become common knowledge the spammers start working on circumventing them. So maybe it's best that this didn't mention any specific tools- just broad categories like virus checkers and firewalls.
SJW: a person who perceives an injustice, and while correcting it, commits a greater injustice.
...let's just all do something before the government really starts to regulate things. I'm stupid about such things, so out of curiosity why hasn't the w3c or the people who write the RFCs come up with some new SMTP spec?...please...
Summary of ASTA Recommendations
Makes me really glad that I push all my email backwards and forwards through an openvpn connection to my mail server now. As long as my ISP doesn't block UDP port *mumble* I'll be fine.
My wife was not so lucky. She was unable to send email a few weeks ago when our cable modem provider instituted outbound port 25 blocking. Luckily it's really easy to set postfix up to listen for smtp on another port as well - one quick config change and she was back in business. I'm planning to install openvpn for Windows on her box one of these days.
That's the only thing that will work on the long run. Everything else just reaches those who are already somewhat aware of the problem.
Unfortunately, calling the customer and walking him through disinfection/reinstall costs too much money, so only very, very few ISPs do it at all.
Don't use Exchange!
I'd be very happy if everyone could get their act together and reject undeliverable addresses during the SMTP transaction. Delayed bounces are responsible for most of the backscatter which pollutes my mailboxes and logs these days.
Qmail, I'm looking at you. People who don't run something like LDAP on their secondary MXs, I'm looking at you.
I'm almost to the point of blocking the null sender from certain hosts, just because they are nothing but crap. I know all about the RFC (and rfc-ignorant.org), but they're causing a serious problem for the rest of the world.
The worst part is for people who run control panels like Plesk. They have to run qmail (no choice in the matter), and so they either become a delayed bounce source, or they enable the catchall and get to suck down all that mail. They can't win.
I know that Congress has done a lot of stupid things to restrict or otherwise put restrictions on all things tech (*cough* DMCA *cough*), but I think that if there were criminal penalties for spamming, then there would be at least a degree less of it. My logic isn't so much that fear of the law will scare people off (There are still 6 million users of P2P networks, regardless of the RIAAs attempts to shut them down or scare them with law and lawsuits), but that here there is a wider economic reason. Sure with music and movie piracy, the lables, artists, and retailers miss out on a bit of money, but it's limited to that market. Spam affects us all - businesses, government, schools - there's a more compelling reason to do something about it. I would also wager that a larg enumber of the spam in the world comes from a limited number of sources (Though, I doubt all are American). Take out the big senders, and it cuts down the numbers - sorta like the drugs war (Take out producers and it will cut down the number of dealers and addicts), but hopefully with better success.
These are of course the companies who have shown themselves to be the least cluefull in the past. If they were serious about establishing best practices, they would have included in the list things like having a cluefull helpdesk that does more than send a canned response to complaints. All help desk employees working on spam issues should be required to know how to read email headers. Part of best practices would include a requirement to shut down web sites that benefit from spam or phising. Nope, sadly these guys are not yet serious, and its obvious.
The worst companies out there for blocking legitimate mail are telling US about best practices to block spam? niiiiiiiiice, I think I'll get to work on their suggestions sometime around February 31st.
Most of exchange problems occur when you have an exchange server being the SMTP gateway. IF I were you, find a product to be the SMTP gateway that doesn't use anything made by Microsoft. There are also serious problems using the IIS SMTP service to talk to exchange. So, in short, get another kind of SMTP gateway to run the SMTP service, and then run Exchange behind it forwarding all mail to your non-microsoft gateway.
But, of course, that might cost the ISP's money. So instead we get a "best practice" document which preaches to the converted and achieves nothing.
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
4 years and I haven't gotten a single spam on my work account. No filters, and I use it dozens of times a day.
/. and you were able to hold a job for four years. Your spam comment is more believable than your employment history.
Honestly, you expect ANYONE to believe that you are on the net enough to get FP on
If port25 is being blocked and you dont want users to change their outgoing smtp servers all the time, what is the best way to have reliable email on laptops.
Is VPN the only way to make mail reliable and consistent on laptops?
*COUGH* bullshit *COUGH*
Out of this list of ISPs (AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast), AOL is the ONLY ISP who is actively working in the antispam community - seriously. They've got a single contact for dealing with it and they are keeping their ax sharp and swinging it whenever needed.
All of those other 'posers are lying thru their teeth. Yahoo, MSN/Hotmail, Earthlink, Comcast? Antispam? They'd choke if they tried to say, "We're antispam". It's sad now that AOL has made a solic effort that they're going to be painted with the same brush as those other spam-havens.
Spammers paid a lot to get their spam out and people like AOL and Earthlink cozied right up. Now it is unpopular so they pretend to be fighting spam. My guess is that then they will hold out for more profit from spammers, it is a cycle of blackmail.
best practices to help fight spam. The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast.
Something that would really help is for these big companies to protect their own domain names by going after anyone who forges the headers as such. These days if someone isn't already in my whitelist they are probably going to get caught in my spam filters if they use any of these domain names.
Under most circumstances I think it is a bad thing for a company to throw lawyers at someone until there is nothing left but a smoking hole in the ground, but I think I would make an exception for spammers. These companies not only have the resources to make spamming unprofitable, but they have a valid, and vested interest to do so.
Howdy Doodly Doo!
Anybody want some Toast?
If you want to kill spammers, kill thier source of income. Fine the hell out of the people ADvertising through them. Hit where it hurts (the bottomline) and spammers would be out of a job.
... of significant size, I would tell my userbase that you must prove to me that your system hasn't been compromised by "Zombie-Ware". A scanner utility would scan their systems remotely and lock out system found to be compromised. Any system owner that refused to be scanned would be removed from the network.
Draconian, yes, but also effective IMHO.
As a mail administrator for a medium size company I've had to deal with residential broadband ISPs blocking access to port 25 a lot lately. It was a headache explaining to employees that work at home, at the office, and at customer sites, that they must change their outgoing SMTP setting in Outlook depending on their location. This is a true PITA as lots of times your not supplied with that information (or at least it is not obvious to the non-technical people), for example, internet access in hotel rooms.
For a while the quick and dirty solution was to use webmail when in doubt but we needed something that people could live with and as much as I dislike M$ Outlook its a lot better than Horde, Neo, or Sruirrel Mail (IMO).
My 80% solution now is to handle SMTP on both ports 25 and, hehe, 26. So far so good, I'm able to go between the office and home on my laptop with no problems where as before Cox Cable wouldnt let me get to our SMTP server.
I'm wondering what other admins have had to do in this situation. I know I'm not alone here. And how do you think it will effect the propogation of spam in the future.
Im dreaming ofa big bndwdth, That can resist the
might help if they publish these in korean and chinese
Considering the amount of spam I have seen from AOL, Yahoo, MSN, Hotmail and Comcast, perhaps these anti spam guidelines should be a 'best practices to avoid' list.
I'm not totally sure if this is directly related to the ASTA statement or not, but Reuters is reporting that major ISPs are pushing to unplug spam-sending PCs.
Personally, I think that this would be a step in the right direction, but one comment in the article has me concerned...
But the group also suggested consumers be held accountable if their machines are exploited by spammers.
Is it reasonable to expect that your average home user will act as responsibly as a company's system administrator at keeping their systems patched? Heck, I'm not all that certain that the sys admins are doing all that great of a job of it (Slashdot readers excepted of course).
Wanted: witty unique signature. Must be willing to relocate.
There's a fairly important and really simple improvement that I'm surprised wasn't covered by this list. Consumers: turn off the 'preview pane' in your email client. Vendors: set the preview pane 'off' as the default when you ship email clients.
The preview pane gets people in so much trouble, especially with Outlook/Express. Without harping over the potential for automatically triggering viruses, a lesser known problem is web bugs. These little images are linked from the email, and when they are retrieved from the server, the spammer is able to record that you've viewed his/her spam. One, this lets the spammer collect statistics, which enables him/her to create a better product -- and why encourage them?
And two, it identifies what email opened the spam, which lets the spammer confirm which addresses are active. If you've viewed the spam, the spammer can put your email on a confirmed-email list, which he/she is then eager to resell at a higher price as opposed to larger lists of unconfirmed addresses.
This is always the first step I recommend to people who complain about the amount of spam they get. This trick won't necessarily reduce your current spam, but it will reduce the accelleration of spam to your inbox.
Punctanym: alternate spelling of words using punctuation or numerals in place of some or all of its letters; see 'leet'
I think we should fast track those best of breed anti-spam practices and implemented to leverage our assets for an enterprise wide robust system. So that at the end of the day we'll all come to the table and be on the same page with a turn key solution.
... I forgot to take my happy pills. BRB
Oops... uh
OK. I feel better now. We'll I'm off to carve my initials in a Moose and then herd some cats.
"You'll get nothing, and you'll like it!"
While the authors say the target audience includes "ISPs and mailbox providers", the list of recommendations reads like a wishlist for large ISPs and email hosters. These are the things that hotmail, yahoo and earthlink want us to do so they don't get as much spam. There is very little in there recommendations that will help me get less spam. If I could use spf to know where hotmail, msn and yahoo send mail from, I'd be able to reject 30% of the spammy organization recieves. This isn't on the list of recommendations, although aol, earthlink, and gmail all do publish spf records.
It's very hard for any mail administrator to block mail from these large domains, because so much of the legitimate mail comes from their actual servers (wherever these are). I'd be happy to reject all mail addresses from msn.com or yahoo.com, but my users would see a huge increase in false positives. It's a no brainer to drop messages addresses from dailyoffers.com because I don't see any legit mail addresed from this domain anyway.
Earthlink and Comcast customers account for a significant amount of SPAM sent to my email server. I have contacted these ISP's repeatedly with date, time, and IP address of the offenders with zero response and I continued to be spammed by these same IP addresses.
I have Earthlink and Comcast designated as "terrible ISP" internally and now firewall out IP addresses sending spam from any ISP so designated.
When people are sending these ISPs all the information required to stop spam and they do nothing, I think anything they have to say regarding stopping SPAM rings hollow.
We are not talking best practices here, they cannot or will not do the minimum.
...Paula Abdul critiquing other people's singing talent, or Christopher Reeve judging a dance contest!
Comcast does not belong on that list, unless you're trying to prove the old saying, "Those who can, do; those who can't, teach."
But are there mail service outfits that support OpenVPN. F'rinstance, DynDNS.org will relay mail for you - either direction. To get around ISP blocking on the incoming side, they give a list of ports they'll support.
But that's still an incoming SYN packet, and how long until ISPs block ALL incoming SYNs? It's against my cable ISPs TOS to run ANY services on the Internet, so they're well within their rights to do this. (Can't get DSL, can't even get V.90, 28 or 32 is IT.)
While technically possible to pretend the UDP used by OpenVPN has state, as IPTable does, and use that to block it, it would be harder to manage for the entire userbase. Forwarding email over OpenVPN would be useful, and by definition protected from relaying.
It would also be no effort to block port 25 outbound, but moving that to a different port is trivial, and they're not going to block THAT without something much smarter, and much more expensive.
The living have better things to do than to continue hating the dead.
Its nice to see AOL, Yahoo, and Hotmail working to eliminate spam. Especially since for years they allowed the majority of spamming to take place on their networks...
I want a new quote. One that won't spill. One that don't cost too much. Or come in a pill.
This was just a bunch of fluff. I was hoping for some meat. The big ISPs have enough clout that if they force the issue of good practices everyone will have to adapt and the people who will have to adapt are those with broken non-RFC compliant servers.
Best practices can encompass the RFCs and extend them to, well, best practices.
For example:
Per RFCs every place a domain is used it must be fully qualified and resolvable. In addition, the EHLO is supposed to be the primary hostname of the sending machine.
Anti-spam best practice might say that the machine name must resolve back to the connecting IP. Even better, the reverse entry for the IP must include the correct hostname. This way a receiving machine can determine who the sender claims to be, that the DNS entry for that name matches the IP (anyone can spoof the header but it's lots harder to get to the DNS of a legit operation) and that the reverse DNS shows the correct hostname (which would be harder on those who have low-end connections where they don't have control over the reverse DNS entries but no problem for most IT operations - anyone with a small operation can send through their ISP anyway).
If the major ISPs required just these items to match there would be a brief period of pain while everyone scrambles to fix broken systems but the gains from stopping viruses and spam would be enormous and tracing back to and blocking the remaining spam would be easier.
I also saw nothing about information sharing among the large ISPs so they could quickly act against a spammer or quickly disable the web accounts to which the spam is directing people (carefully, of course, or fake spam could be a means of a DOS attack).
Similarly, there was no mention of blocking email where the from address doesn't match the ISP. A couple years ago I dealt with massive backscatter from spam sent by an Earthlink customer THROUGH the Earthlink server. I tried to get an answer from them on why they were allowing someone to send out email "from" our domain when they have no relationship to us. Silence. Sure this is a pain for some people but people who want legitimate extra services can sign up for them. It's not so different than paying for a static extra IPs. If you want to send from a different domain we'll unblock it for you for a small monthly fee after determining that you are authorized to represent that domain.
This just scratches the surface but all in all this "best practices" is a joke.
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
I run my own mailserver and when i tried to add smtp-time spam protection by checking the helo provided domain-name i found out that even big mail systems like sourceforge don't send correct helo information. the smtp rfc requires HELO/EHLO before the MAIL FROM command is issued. if the reverse-lookup of the connecting IP does not match the given domain-name in HELO command simply delay the connection for 20seconds (tarpitting) and close the connection.
This would work very nice because then you can at least identify the spammer (must have domainname + reverse entry which makes tracking down the owner of the domain quite easy) - but it does not because even the admins of big servers arent able to set these basic things up correctly.
I'd love to see these huge ISPs to start forcing correct HELO commands, this way people will start to setup things correctly. This will certainly not stop spam but it will make the senders identifyable (or make owners of hacked machines contactable). I see no valid reason why this basic feature of smtp isn't used. Okay the RFC does not make correct domain-names mandatory for the helo command, but current issues with mails do i think. Use what's there already! and kick the butts of the lazy admins.
I have a command-line alias set up to use SSH port reflection from port 25 on my laptop to port 25 on my server. My mail client is then configured to use localhost as the outgoing mail server. Whenever I need to send email, I just need to enter one command in a terminal window to enable it until I move elsewhere and the connection is broken.
I used to just run sendmail directly on my PowerBook, but I got too many bounce messages from servers that refuse to accept mail from known dynamically allocated IP ranges, on the assumption that I must be a zombie spammer.
There's a paypal phising sploit out there too, so methinks this be a troll who is also a phisher.
Not a spammer but a hacker problem I had once, he was hitting me and some people on a political forum I was moderating. I tracked him (guy in his early 20's) down (he was very surprised to get found out, BTW, I guess he thought he was elite or something) and let him know I wouldn't go to the police, or his ISP or "take him to court" or any of that nonsense, just visit severe and long lasting pain on his person and leave him unable to operate a phone, mouse or keyboard if he didn't immediately cease his anti social behavior. I'm from the old school, and this method has always worked, never seen it fail yet. He stopped what he was doing, at least to myself and some aquaintances. It's hard to track people down but you can if you get motivated and develop some alternative skills.
That's the only thing that will stop spammers and blackhats, IMO. I am not advocating anyone else do that, that's illegal of course, just relating what I did in one situation. Playing arty/armor/arty/armor in an escalation of technology won't work, all it does is waste resources and never addresses the root of the problem-that some people are just criminals and need an attitude adjustment.
As to boneheads who can't operate their computer-shut off their email if they get caught being a relay or anything, shut them off the web if they get zombiefied. If my machine gets compromised because I've been a bonehead-then so be it- I have no problenm with my ISP shutting me off until I fix it.
I get my DSL through Earthlink, but my domain is hosted elsewhere. So I don't ever use my Earthlink email address. The ONLY legitimate email coming to that address is my monthly billing statement. And for the last few years, that's pretty much all I got. Sometimes Earthlink itself would send me spam, but it was nothing an embarassing submission to abuse@earthlink.com couldn't handle.
But they recently stopped their server-side spam filtering (Spaminator(tm)) and replaced it with client-side plugins. Overnight I started receiving thirty spams a day to an account that I have NEVER used. Besides the general annoyance that they are shuffling off anti-spam responsibilities to the customer, their plugins are for Windows Outlook and webmail only. (They say it's for Mac as well, but that's only a euphemism for "you must use webmail"). This is unacceptable.
Don't blame me, I didn't vote for either of them!
It seems to me that if someone has a chronically broken box spewing spam and trojans and whatnot constantly, that they are exactly the types of customers the ISP's lose money on. It shouldn't bother them at all to drop a customer and save on bandwith and headaches and admin costs. Just taking in more gross revenue doesn't necessarily always mean you make a net profit on it.
Say you run a bar, and have a really obnoxious drunk, insulting people, vomiting on the floor, etc, just a PITA. He's spending money though, you are taking in more gross revenue from his business, but would you be better off kicking him out and just concentrating on the patrons who could hold their liquor? In the long run, people, the customers you really want to be regulars, will come back to the bar that keeps itself within some bounds. That's why I think blocking whole subnets is acceptable as well, there are just some places that need to be cutoff completely with interacting with the rest of the internet until they clean up their act.
best practices? Several of these ISPs use BrightMail... never mentioned it in the article though. I can attest to the fact that BrightMail has reduced my level of spam to such a low level I think people are lying when they say they still get spam!
The problem is sometimes the organization sending/financing the spam is NOT what it appears to be. Sending offensive spam on behalf of a company you don't like is called Joe Jobbing, and it's common practice. When you take revenge, make sure you're taking revenge on the right people.
Sure it's best if the message can be refused during the SMTP transaction rather than bounced after the fact. But sometimes that's not possible - for example in the case where a message has already been accepted by a backup mail exchanger or when the message is detected as undeliverable by the MDA after the MTA has already accepted it. In any case, when faced with the choice of returning a message or simply discarding it, returning it will always generate the least unmitigatable collateral damage. The real owner of an envelope sender address faked on a junk message can minimize collateral damage by refusing fake bounces at the SMTP transaction level. In that case, it only cost them a few bytes of bandwidth. If junk messages are simply discarded, the sender of a misclassified message has no way to prevent, detect, or work around the silent loss of his message.
You can filter fake bounces with 100% reliability by ensuring that each of your legitimate outbound messages has a time-expired, hash-signed envelope sender. Any automatic responses or bounces which arrive and don't include a valid hash are obvious forgeries and can be safely discarded. You can even refuse these right at the RCPT stage by having your MTA return a 5xx series status code.
For more information, see this Internet Draft on Bounce Address Tag Validation (BATV) and a few shell scripts on my web site at http://osiris.978.org/~brianr/bouncevalidation/ which implement fake bounce detection at the MDA stage.
No, this it the beginning of legislative effort. They clearly state this at the end of their press release. The object is to get laws passed about what ISPs do and to make the net easy for them to control. It's everything the people who designed the internet fought against and what is left will more resemble broadcast TV.
The goal, of course, is to secure government protection for the current status of the companies and to stomp out free software. Any kind of government regulations place barriers on new entrants. The proposed solutions are, in part, Microsoft solutions. Microsoft will be at an advantage to limit the number of ISPs and they can do that if legislation requires the use of Microsoft junk. Even if the members can guide the legislation and defeat Microsoft, the email authentication requirements can be used to defeat new ISP entrants. They are attempting to make the network "smart" so that they can control it.
The trend is unmistakable, these guys want to be the "asshole in the middle" of everything. They destroyed AtHome, DSL providers and all semblence of competition in the ISP market. Now they are using that control to gain even more. They have the gaul to advocate "legitimate" spam in their press release.
All of this places the blame far from where it belongs. Spam is a problem that comes from and mostly affects Microsoft run computers. It is disgusting that the trouble maker will be one of the main beneficiary of the proposed solution.
Friends don't help friends install M$ junk.
One major question anyone reading this has to ask is -- what constitutes a "legitimate need" to run a mail server (people meeting this condition are those who ISPs should open port 25 for, according to the official doc). I run my own mail server, and have since 2000; additionally, I give out accounts to any of my friends and family that want them. The reason I do this, and the reason people get accounts on my box, is the lack of (unreasonable) restriction I impose on them: no mailbox size limit, no outbound mail size limit, as many aliases as they feel like (of course, I don't run an open relay, and I'd cancel an account instantly if I found someone spamming through it). If I were forced to move to some hosted solution, I would lose a lot of features, and have to pay to boot.
So is it necessary for me to run a mail server? No, I could technically survive without my own. Would it be a travesty if I were forced to switch to cut off spammers? Hell yes!
So until they draw the line on who "needs" to run a mail server, I can't possibly support this concept (or at least the port 25 restrictions piece of it).
How To Get Humans To Mars
There is a group called MARID debating this issue right now. We have already decided that the way to defeat spam is first to authenticate every email. SPF and CallerID are the two major proposals for this, and right now, they are working on a compromise.
The radical sect of Islam would either see you dead or "reverted" to Islam.
I use VMS mail and DECNET with no IP routing
I get no spam 'cause nobody else in the world can reach me!
I understand that there is no silver bullet to end spam. But recommendation that this document does not address is the hosting of the web site advertised in the email. If spammers also could not find places to host their sites, the utility of spam (to the spammer) would significantly decrease.
The irony is that Yahoo appears to be fairly spammer-website friendly. They kill abusive Geocities pages fairly rapidly, but paying users appear to be basically bulletproof.
I've got one pet spammer (http://suburbanexpress.site.yahoo.net/) that's been hosted from Yahoo and spamming from an Ameritech DSL line since November, and neither will do anything about it.
Bouncing = rejecting an email on the receiving end for some reason
/etc/aliases and .forward files do)
Forwarding = sending a nearly identical copy (headers and everything) of an email to another destination (what
"Bouncing" = Forwarding
"Forwarding" = resending (sending a copy of only the contents of the original email inside of a new email message)
All I want is a kind word, a warm bed and unlimited power.
The only real answer is to swap it so that the sender holds the message until the receiver requests it. And that requires scrapping the existing system.
Spam is here until this incarnation of email dies, or everyone whitelists....
#### ## Laroue ####
Suspiciously render what's delivered, and put placeholders for IMG tags. Like in the good ol'days, press "LOAD Images" to see it all". MS has made some very insecure design decisions.
Note that the RFC uses the same term "domain" which it defines in Section 3.6 for the ehlo/helo and the "ehlo-ok-rsp" server response domain "field" in the grammar which defines the protocol.
The "domain" field in the grammar doesn't mean domain like x.com, it means domain name as defined in section 3.6
This part of the RFC is conveniently ignored/overlooked by many people and long used practices make people believe that the RFC says something that it doesn't.
I agree that retransmitting someone else's message to a new recipient will be seriously problematic in SPF land and will break ".forward" files all over the world.
Until a millisecond after the user replaces
...in his .forward file with...
...and the sysadmin inserts these two lines into /etc/aliases (after installing Mail::SRS from CPAN):
It's documented. And amply so, too.
Rick Moen
rick@linuxmafia.com
thanks for pointing that out, i fixed the helo for my server now.
I still think that valid reverse entries should be enforced though. The post you linked to makes a point for small domains - well if the reverse entry is domain.com so be it - tell the mailserver to use domain.com for helo commands. Load balancing systems consist of many mailservers - if i have a system that has 5 mailserver behind one router == on IP then i tell all 5 mailservers to use the correct name for that IP. if i run 5 server using dns-round robin i use correct names for each of the five. what sourceforge does is:
which is clearly not the boxes name sending the mail, even though it could be configured correctly. Maybe i am missing some important point, but i guess setting up valid reverse lookups is possible, and should be checked.I know that the RFC does not enforce this, that's why i _suggested_ to do so. And if the others would do it i would have noticed earlier that my setup is flawed, because others wont accept my mails.
Blocking outbound port 25 has the effect that zombies cannot send mail to SMTP servers listening on port 25. (Incidentally, it also has the effect that completely legitimate and well-behaving mail servers on the network cannot do so either -- unless there is some form of more or less manual unblocking which the customers can apply for/use)
HAND.
Is it just me, or does adding comcast to a group trying to prevent spam seem like a step backwards? Granted, they're finally doing something to limit the spam coming from their own network, but how long did it take them to do that?
The recommendations for "legitimate" bulk e-mail senders are purposily vague just so that MS can continue to declair that MS bCentral.com sends "legit" bulk e-mail.
... without the owners' affirmative consent."
Consider the following:
"Do not harvest e-mail addresses
They do not provide any details as to define "owner" or "affirmative consent." Legit mailing list servers will frequently email a random string which must be replied to via email to confirm that the email address is correct and the person claiming to own it can actually recieve email at that address. MS bCentral customers will frequently send email based on the fact that someone filled out a web form *claiming* to be the owner (no confirmation via email). Hence, MS will make no distinction between email confirmation and web form "confirmation" of email subscription. In fact, MS bCentral claims no responsiblity to provide any logs as to where/when/who issued a subscription request , they only state that the customer claims that such an act took place at some unknown place and unknown time by someone claiming to own the email address. If someone accidently or purposily put an incorrect email address then the actual owner must go through the work of opt'ing out. Which leads to my next point...
- "Always provide clear instructions to customer about how to unsubscribe or opt-out of receiving e-mail."
Oh. I frequently get "clear instructions." I get clear instructions on what web page to go to. I get clear instructions on how to enable cookies in my web browser. I get clear instructions on how to check the box saying I agree with all the terms of services document for the website. Regardless of if it is clear:
- I should not have to open a web browers to opt out.
- I should not have to change how my web browser is configured to opt out.
- I should not have to agree to anything to opt-out.
Again, if it stated that a clearly documented method of removal via **email** reply (with no additional web/phone/snail-mail hoops to go through) must be provided then some of the emails sent by MS bCentral would no longer be legit. Therefore, they give a recommendation that still allows demanding the user jump through hoops via a web browser to remove themselves from the email list. The ATSA does not take into consideration the fact that just because a device is capable of recieving/sending email does not mean it is capable of web browsing. Rather, their priority is defining "legit" bulk e-mail in such a way that the opt-out methods "provided" by bCentral are legit.
The basic common sense rules of subscription and unsubscription from mailing lists do not apply to bCentral so it appears they also do not apply to the ASTA defination of "legit" bulk e-mail. When the ASTA is made up of only members that themselves follow the logical rules of mailing lists, then maybe they will make recommendations that make sense. Until then, skip the ASTA vague crap and just blacklist bCentral -- "legit" bulk e-mail my behind.
Seriously, why don't these guys get together and sponsor a massive ad campaign telling people something to the effect of "each year, spam costs this much, and it ends up being paid by you. stop purchasing stuff advertised through unsolicited email. it's up to you"
Increasingly, it looks like it really is up to users alone to kill spam's bussiness model. If nobody buys from them, they're toast.
I'm sure some spammer association (DMA) will object to such a campaign, but screw them, go do something useful for a change.
This is great and they can all do more to educate consumers as well as take "best practices."
What I want it the right to hunt down and kill the worthless scum that have hijacked my domain name. They send out tons of spam daily using it as the from @domain.com. I get a several hundered "message undeliverable" messages a day as the result of my domain name being hijacked. As there is no SMTP server it's impossible for me or anyone else to send mail from my domain. All the mail to my domain is routed through NetworkSolutions and forwarded to a working addess. Zero is originated from that particular domain.
I just want to find the fucker and put my 45 up their ass and slowly pull the trigger about 5 times before I put 2 in their head. My domain is my actual given name so I consider it a valid reason to kill the worthless fuckers.
So how DO you detect zombies on your network? I've wondered about this for a long time and would love to know what ports these zombies listen on so I can scan for them. Any one have any ideas?
All email lists must be created by confirmed opt-in, without exception.
All subscriptions are for one mailing list only. They may never be used for any other purpose, including "related" mailings from the same organization and automatic subscription transfers to a "replacement" list if the list folds. If the subscriber didn't explicitly ask for it, it's junk mail!
Unsubscribe requests must be processed through plain-text email to an address in the originating domain.
Users should be taught to never use any URLs in unsolicited or suspect email, and that all such links should be considered malicious. In particular, "click here to remove" is to be considered synonymous with "attack my PC".
Legitimate mailing lists messages never include scripts, attachments, or executable content of any description. If executables are part of the list's charter, they will be accessed only by user-initiated download, never by attachment or automatic invokation. I could go on much longer, but that covers my most common gripes!
Microsoft is being disingenuous by being a member of the group. They first need to delete Outlook completely, own up to the incredible damage its "cool" features have allowed, and then start participating in the effort to reduce SPAM and email worms. Oh, and maybe release an email client that is at least as clean as the best of the others out there.
It could be that 66.35.250.206 which is lists.sourceforge.net (which makes sense) is a firewall machine or load balancer that all the outgoing mail goes out through and that the name is different because if someone sends incoming connections it takes a different pathway, I am not sure. I think there are just too many different firewalling and load balancing methodologies for the reverse thing to ever work consistently.
If you want to try to get admins to pay more attention to overall configuration issues and screen out those who don't follow certain RFC rules then check out RFC Ignorant
I find that domains that refuse to create and respond to proper admin addresses are people who tend to fluant other rules and netiquette. The bogusmx list is especially telling because pure spam domains sometimes will list bogus MX records.
What about using the OpenBSD spamd with greylisting to greylist everything that isn't known to fight back, when it finds an actual spammer, spamd ties up the spammer's or zombies connections (by only return one character per second) without using alot of your resources. Spammers don't make alot of noise about this because they don't want to bring attention to the only thing that is really effective as far as giving them some trouble - other than that guy who fills up their product website forms with fake credit card info Unsolic Commando. If these two techniques caught on, it could put a serious crimp in spammers easy lives.
Oh no! You were forced to comply with the later RFCs!
RFC 2476 states:
3.1 Submission Identification
Port 587 is reserved for email message submission as specified in this document. Messages received on this port are defined to be submissions. The protocol used is ESMTP [SMTP-MTA, ESMTP], with additional restrictions as specified here.
In other words, for submitting to an MTA, you're supposed to be using 587, not 25, these days. 25 is for inter-MTA traffic. (In practice, allowing submissions on port 25 is often required as well, as that RFC itself states in the paragraph straight after.)
While most email clients and servers can be configured to use port 587 instead of 25, there are cases where this is not possible or convenient. A site MAY choose to use port 25 for message submission, by designating some hosts to be MSAs and others to be MTAs.
Try to explain to SBC that the reason your server's rDNS doesn't match the FQDN is that their rDNS is wrong. I tried that, the first time SBC bounced mail from the server in question. I was told that DNS was my responsibility, unless I was willing to turn it entirely over to them... for an extra charge, and they still wouldn't fix the rDNS, if we did. The third time the second-level tech told me to "fix our own DNS", I requested that he delegate the rDNS for the 65.43.0.0/16 subnet to me, and I'd fix it in an hour!
(of course, the rDNS for some of the other IPs in that block might stop working right, but that isn't MY problem...)
As for having the HELO match the domain of the envelope sender, well, that's tougher. We only host about 50 domains, but they all pass through two servers. Due to the way DNS works, it's not a "best practice" to list "mx.domain1.net" as the mail exchanger for "domain2.net" (although some major ISPs do it), so domain2.net might list list "mx.domain2.net", giving the same IP as "mx.domain1.net" uses. What should the mail server send as a HELO when forwarding mail for domain2.net?
We solved this by always having the mail servers send their own host names. All the domains claim their own FQDN mail server, with the IP of the consolidated server. If you do a MX lookup on the envelope sender, you'll get a matching IP with the sending computer. If you do an rDNS lookup, you'll get a matching host name for the HELO hostname. And, now, if you do an SPF lookup on the domain, you'll also get confirmation of the server's validity in handling mail for that domain. We're going to implement Microsoft's "CallerID for email" when/if we decide we can live with the license agreement...
Just validating HELO==rDNS or that the HELO matches the domain of the MAIL FROM is something the spammers have moved beyond already. Hundreds of times per day, I get things like the following:
HELO pcp03753391pcs.walngs01.pa.comcast.net
The rDNS on the IP matches the HELO command perfectly... but, it's not a valid mail exchanger for COMCAST.NET. Without additional help, all the spammer has to do is claim a MAIL FROM in the COMCAST.NET domain to get in, if you ONLY validate the HELO against the rDNS.
Right now, we have filters in place to block certain HELO/EHLO domains. We block any attempt to claim to be one of our servers, or any claim to be "aol.com" or "yahoo.com" (both use rDNS-matching FQDNs in their HELOs), but can't do that for HOTMAIL.COM or MSN.COM, because SOME Microsoft servers just send "HELO HOTMAIL.COM", just like the spammers. Grrr...
The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast.
The reason I dropped Earthlink in the first place was because THEY were spamming me. I doubt if their heart is suddenly in it.
I skimmed through the pdf file and it mentioned verifying the sender of an email message. That can be done by connecting to the sender's mailserver and issuing a VRFY command for that sender. The problem is, is that because of spammers, the VRFY command has been 'disconnected' to prevent dictionary-style attacks to guess user email addresses.
To have the best of both worlds, bring back the VRFY command to verify single email addresses AFTER waiting for some long delay (such as 50 odd seconds as Outlook Express will 'time out' after 60 seconds of inactivity). This way, spammers are thwarted and senders are verified. In an earlier post on another thread I suggested only having official, DNS-recognized mailservers talk to one another and nobody else will go a long way to cut down spam and eliminate the layer of IP address anonimity given spammers by open/Trojan-created relay mailsystems.
But surely the best way to avoid spam is to:
1. Pick an email address that is not easily auto-generated.
2. Only give this email address to friends/colleagues. Dont use it for newsgroups, email-subscription, etc.
This works a treat for me. I have one email address that I use for work that I setup a year ago, and have not had a single spam to date. I have another email address (on Yahoo!) for everything else.
Or am I missing something obvious?
James
http://www.reeb.freeserve.co.uk
I created a simple script to generate temporary email addresses that I can use to post on the web. I send an email to temp_address@mydomain.com and qmail sends me an email address that forwards mail to my normal address in a form like expire_07day_20040618_103454fqcv@mydomain.com my crontab removes the aliases that are older than 7 days. Very convenient and works nicely. Coincidentally, Yahoo mail added this type of feature at about the same time I did.