Major ISPs Publish Anti-Spam Best Practices

wayne writes "The ASTA, an alliance of major ISPs, has just published a set of best practices to help fight spam. The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast. The recommendations include such things as limiting port 25 use, rate limiting email, closing redirectors and open relays, and detecting zombies. For details, see the ASTA Statement of Intent (pdf) or any of the ISP's antispam websites."

Comments

What about my personal mail server?

[tstoneman]

I am thinking about setting up my own personal mail server for my small business.

Is there a guideline that can help me figure out what steps I need to take to harden my mail server?

I will be using either Postfix or Microsoft Exchange.

Re:What about my personal mail server?

[Not_Wiggins]

How is that any different except you have to update your aliases file (or whatever config) anytime you wish to create a new ID?

As least I can just log onto amazon and create me+amazon@myrealdomain.com without a thought.

Or, are you saying that mail to whomever1@whatever.com, whomever2@whatever.com will always forward on you you@myrealdomain.com?

It essentially is the same problem as having your "real" (final) e-mail address out there for the world to see... maybe worse, if you have it setup as a "catch-all." Filtered into a separate mailbox, you're still getting all the spam.

But, I think you'll agree, the solution isn't really in either of our setups... it is in nailing the spamming bastards to the walls. That would require better authentication/validation of sender identity and location. At least if we could trace the mail back to a real person, things would change in more of a hurry.

BTW, have you thought about implementing grey-listing in your postfix config? (Just in case you're not familiar: it associates a triplet with incoming mail... the sender, the receiver, and the originating IP). First time it sees a triplet, it logs it and rejects it with a 450 (temporary) error. Most spammers never bother with retries, so it can effectively bounce messages out. Real mail programs will retry... and on the second (and future) attempts, it'll just go through. Sure, it delays the mail a little, but it weeds out a *lot* of spam. 8)

Take what they say with a grain of salt

[Raul654]

How many of those ISPs were caught in pink contracts?

Blocking outbound port 25

[Bronster]

Makes me really glad that I push all my email backwards and forwards through an openvpn connection to my mail server now. As long as my ISP doesn't block UDP port *mumble* I'll be fine.

My wife was not so lucky. She was unable to send email a few weeks ago when our cable modem provider instituted outbound port 25 blocking. Luckily it's really easy to set postfix up to listen for smtp on another port as well - one quick config change and she was back in business. I'm planning to install openvpn for Windows on her box one of these days.

Re:Blocking outbound port 25

[warpSpeed]

Makes me really glad that I push all my email backwards and forwards through an openvpn connection to my mail server now.

Openvpn rocks! I have started to use it for clients that I relay mail for, and back their systems up remotly. It works with Win32-Linux,Windows-Win32, Linix-Linux.

I run open VPN on my laptop and tunnel back to the mothership for access to all my local services at home too.

I have converted a few people using remote laptops over to it for various applications and it is pretty solid.

To stay on topic here, openvpn is a great tool to overcome the limitations of using many mail servers out there.

Re:Whatever...

[IamGarageGuy 2]

That would be the way to go... but unfortunately life doesn'r work that way. SMTP is so entrenched everywhere that writing a new spec is like making a new internet. In theory, it's easy, in reality everybody would bitch that their email doesn't work.

What about laptops

[Marrow]

If port25 is being blocked and you dont want users to change their outgoing smtp servers all the time, what is the best way to have reliable email on laptops.

Is VPN the only way to make mail reliable and consistent on laptops?

Mail admin here, my solution was port 26

[aardwolf204]

As a mail administrator for a medium size company I've had to deal with residential broadband ISPs blocking access to port 25 a lot lately. It was a headache explaining to employees that work at home, at the office, and at customer sites, that they must change their outgoing SMTP setting in Outlook depending on their location. This is a true PITA as lots of times your not supplied with that information (or at least it is not obvious to the non-technical people), for example, internet access in hotel rooms.

For a while the quick and dirty solution was to use webmail when in doubt but we needed something that people could live with and as much as I dislike M$ Outlook its a lot better than Horde, Neo, or Sruirrel Mail (IMO).

My 80% solution now is to handle SMTP on both ports 25 and, hehe, 26. So far so good, I'm able to go between the office and home on my laptop with no problems where as before Cox Cable wouldnt let me get to our SMTP server.

I'm wondering what other admins have had to do in this situation. I know I'm not alone here. And how do you think it will effect the propogation of spam in the future.

Re:Mail admin here, my solution was port 26

[plcurechax]

As a mail administrator for a medium size company I've had to deal with residential broadband ISPs blocking access to port 25 a lot lately. It was a headache explaining to employees that work at home, at the office, and at customer sites, that they must change their outgoing SMTP setting in Outlook depending on their location. This is a true PITA as lots of times your not supplied with that information (or at least it is not obvious to the non-technical people), for example, internet access in hotel rooms.

Um. Shouldn't you be fixing the problem, which is that you want these remote users to act as if they are part of your trusted corporate network? When you look at it this way, you realise that the best (and far more secure) solution is to be using an VPN into a DMZ that can access limited services needed for tele-commuters and road warriors.

Re:Best practices,... published?

[LehiNephi]

Attacking the source of the money--that, I believe, is the only way to kill spam.

That's why I run Unsolicited Commando. It fills the inboxes of companies that pay for spam with spurious form fill-outs. I guess it's kind of like giving them a taste of their own medicine.

target audience

[earlytime]

While the authors say the target audience includes "ISPs and mailbox providers", the list of recommendations reads like a wishlist for large ISPs and email hosters. These are the things that hotmail, yahoo and earthlink want us to do so they don't get as much spam. There is very little in there recommendations that will help me get less spam. If I could use spf to know where hotmail, msn and yahoo send mail from, I'd be able to reject 30% of the spammy organization recieves. This isn't on the list of recommendations, although aol, earthlink, and gmail all do publish spf records.

It's very hard for any mail administrator to block mail from these large domains, because so much of the legitimate mail comes from their actual servers (wherever these are). I'd be happy to reject all mail addresses from msn.com or yahoo.com, but my users would see a huge increase in false positives. It's a no brainer to drop messages addresses from dailyoffers.com because I don't see any legit mail addresed from this domain anyway.

Re:Don't forget SPF

[Dimensio]

I even noticed my ISP, Verizon, who tend to be quite lazy and stupid when it comes to spam (and other things), have added an SPF record.

I wouldn't call Verizon "lazy and stupid" when it comes to spammers on their network. I would call them "criminally negligent".

They had a spammer's website on their network for over a month. The spammer was selling a product that was blatantly illegal (digital cable descrambler). The only possible way that their product could have been legal was if it did not function as advertised, and then they would have been committing advertising fraud, so either way they were breaking the law and Verizon was allowing it to happen on their network. After a MONTH of daily complaints about the site, it only disappeared AFTER I setup a webpage documenting Verizon's open support of criminal activity and started advertising it in my .signature file.

No legal threats were ever issued to me. I guess that Verizon knew that I had truth on my side.

Where are the best practices

[linuxwrangler]

This was just a bunch of fluff. I was hoping for some meat. The big ISPs have enough clout that if they force the issue of good practices everyone will have to adapt and the people who will have to adapt are those with broken non-RFC compliant servers.

Best practices can encompass the RFCs and extend them to, well, best practices.

For example:

Per RFCs every place a domain is used it must be fully qualified and resolvable. In addition, the EHLO is supposed to be the primary hostname of the sending machine.

Anti-spam best practice might say that the machine name must resolve back to the connecting IP. Even better, the reverse entry for the IP must include the correct hostname. This way a receiving machine can determine who the sender claims to be, that the DNS entry for that name matches the IP (anyone can spoof the header but it's lots harder to get to the DNS of a legit operation) and that the reverse DNS shows the correct hostname (which would be harder on those who have low-end connections where they don't have control over the reverse DNS entries but no problem for most IT operations - anyone with a small operation can send through their ISP anyway).

If the major ISPs required just these items to match there would be a brief period of pain while everyone scrambles to fix broken systems but the gains from stopping viruses and spam would be enormous and tracing back to and blocking the remaining spam would be easier.

I also saw nothing about information sharing among the large ISPs so they could quickly act against a spammer or quickly disable the web accounts to which the spam is directing people (carefully, of course, or fake spam could be a means of a DOS attack).

Similarly, there was no mention of blocking email where the from address doesn't match the ISP. A couple years ago I dealt with massive backscatter from spam sent by an Earthlink customer THROUGH the Earthlink server. I tried to get an answer from them on why they were allowing someone to send out email "from" our domain when they have no relationship to us. Silence. Sure this is a pain for some people but people who want legitimate extra services can sign up for them. It's not so different than paying for a static extra IPs. If you want to send from a different domain we'll unblock it for you for a small monthly fee after determining that you are authorized to represent that domain.

This just scratches the surface but all in all this "best practices" is a joke.

Earthlink != Best Practices

[Brandybuck]

I get my DSL through Earthlink, but my domain is hosted elsewhere. So I don't ever use my Earthlink email address. The ONLY legitimate email coming to that address is my monthly billing statement. And for the last few years, that's pretty much all I got. Sometimes Earthlink itself would send me spam, but it was nothing an embarassing submission to abuse@earthlink.com couldn't handle.

But they recently stopped their server-side spam filtering (Spaminator(tm)) and replaced it with client-side plugins. Overnight I started receiving thirty spams a day to an account that I have NEVER used. Besides the general annoyance that they are shuffling off anti-spam responsibilities to the customer, their plugins are for Windows Outlook and webmail only. (They say it's for Mac as well, but that's only a euphemism for "you must use webmail"). This is unacceptable.

What Constitutes a Need For Mail Servers?

[schnarff]

One major question anyone reading this has to ask is -- what constitutes a "legitimate need" to run a mail server (people meeting this condition are those who ISPs should open port 25 for, according to the official doc). I run my own mail server, and have since 2000; additionally, I give out accounts to any of my friends and family that want them. The reason I do this, and the reason people get accounts on my box, is the lack of (unreasonable) restriction I impose on them: no mailbox size limit, no outbound mail size limit, as many aliases as they feel like (of course, I don't run an open relay, and I'd cancel an account instantly if I found someone spamming through it). If I were forced to move to some hosted solution, I would lose a lot of features, and have to pay to boot.

So is it necessary for me to run a mail server? No, I could technically survive without my own. Would it be a travesty if I were forced to switch to cut off spammers? Hell yes!

So until they draw the line on who "needs" to run a mail server, I can't possibly support this concept (or at least the port 25 restrictions piece of it).

Another point: web pages

[eaolson]

I understand that there is no silver bullet to end spam. But recommendation that this document does not address is the hosting of the web site advertised in the email. If spammers also could not find places to host their sites, the utility of spam (to the spammer) would significantly decrease.

The irony is that Yahoo appears to be fairly spammer-website friendly. They kill abusive Geocities pages fairly rapidly, but paying users appear to be basically bulletproof.

I've got one pet spammer (http://suburbanexpress.site.yahoo.net/) that's been hosted from Yahoo and spamming from an Ameritech DSL line since November, and neither will do anything about it.

Re:Another point: web pages

[GorillaButt]

Not so. Many forms of spam today have ZERO websites advertised like Diploma spam with phone numbers, Stock tips which simply advertise the ticker symbol, and a host of phishing and 419 scams. I do agree that sites should be shut down, but it is a secondary issue. We need to shut off the source of where the spam comes from and work back to the spammer him or herself.