Slashdot Mirror
Major ISPs Publish Anti-Spam Best Practices
wayne writes "The ASTA, an alliance of major ISPs, has just published a set of best practices to help fight spam. The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast. The recommendations include such things as limiting port 25 use, rate limiting email, closing redirectors and open relays, and detecting zombies. For details, see the ASTA Statement of Intent (pdf) or any of the ISP's antispam websites."
Several large ISPs are backing SPF. I even noticed my ISP, Verizon, who tend to be quite lazy and stupid when it comes to spam (and other things), have added an SPF record.
I am thinking about setting up my own personal mail server for my small business.
Is there a guideline that can help me figure out what steps I need to take to harden my mail server?
I will be using either Postfix or Microsoft Exchange.
As long as i still can run my own smtp server.
They can limit outbound port 25 because i still can forward my email through their official smtp server. If they limit inbound port 25, it will suck big time.
How many of those ISPs were caught in pink contracts?
To make laws that man cannot, and will not obey, serves to bring all law into contempt.
--E.C. Stanton
...let's just all do something before the government really starts to regulate things. I'm stupid about such things, so out of curiosity why hasn't the w3c or the people who write the RFCs come up with some new SMTP spec?...please...
And just like all crime, all we can do is fight back. We either find the weakness ourselves and fix it, or we find out that a criminal (spammer) found a weakness and we fix it. To sit and do nothing would be really bad (imagine windows XP with all the flaws dating back to windows 3.1) :)
I mod down so you can mod up. Your welcome.
Summary of ASTA Recommendations
Makes me really glad that I push all my email backwards and forwards through an openvpn connection to my mail server now. As long as my ISP doesn't block UDP port *mumble* I'll be fine.
My wife was not so lucky. She was unable to send email a few weeks ago when our cable modem provider instituted outbound port 25 blocking. Luckily it's really easy to set postfix up to listen for smtp on another port as well - one quick config change and she was back in business. I'm planning to install openvpn for Windows on her box one of these days.
I'd be very happy if everyone could get their act together and reject undeliverable addresses during the SMTP transaction. Delayed bounces are responsible for most of the backscatter which pollutes my mailboxes and logs these days.
Qmail, I'm looking at you. People who don't run something like LDAP on their secondary MXs, I'm looking at you.
I'm almost to the point of blocking the null sender from certain hosts, just because they are nothing but crap. I know all about the RFC (and rfc-ignorant.org), but they're causing a serious problem for the rest of the world.
The worst part is for people who run control panels like Plesk. They have to run qmail (no choice in the matter), and so they either become a delayed bounce source, or they enable the catchall and get to suck down all that mail. They can't win.
Most of exchange problems occur when you have an exchange server being the SMTP gateway. IF I were you, find a product to be the SMTP gateway that doesn't use anything made by Microsoft. There are also serious problems using the IIS SMTP service to talk to exchange. So, in short, get another kind of SMTP gateway to run the SMTP service, and then run Exchange behind it forwarding all mail to your non-microsoft gateway.
But, of course, that might cost the ISP's money. So instead we get a "best practice" document which preaches to the converted and achieves nothing.
TWW
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
just like we should not publish our source code because then hackers will find exploits, right?
-ninjaneer
*COUGH* bullshit *COUGH*
Out of this list of ISPs (AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast), AOL is the ONLY ISP who is actively working in the antispam community - seriously. They've got a single contact for dealing with it and they are keeping their ax sharp and swinging it whenever needed.
All of those other 'posers are lying thru their teeth. Yahoo, MSN/Hotmail, Earthlink, Comcast? Antispam? They'd choke if they tried to say, "We're antispam". It's sad now that AOL has made a solic effort that they're going to be painted with the same brush as those other spam-havens.
Spammers are like a retrovirus. The will adapt to any system you construct. Creating a list of what every major isp will do to combat them will only serve to accelerate their evolution and make them more effective spammers.
Spammers always try to be one step ahead of the game. Just by keeping the best practices a *secret* wound't help to combat spam. Its the business model that needs to be attacked. Money is made somewhere and that is where we have to attack. Having said that, I think its important we keep these fighting techniques open. A lot of people would benefit from it. Also, just like security, obscurity would be of no help.
Yes. There's one going around now titled best practices to help fight spam Delete that one right away.
But be sure to verify your Paypal information, that one's legit.
best practices to help fight spam. The list of ISPs include the likes of AOL, Yahoo, MSN/Hotmail, Earthlink and Comcast.
Something that would really help is for these big companies to protect their own domain names by going after anyone who forges the headers as such. These days if someone isn't already in my whitelist they are probably going to get caught in my spam filters if they use any of these domain names.
Under most circumstances I think it is a bad thing for a company to throw lawyers at someone until there is nothing left but a smoking hole in the ground, but I think I would make an exception for spammers. These companies not only have the resources to make spamming unprofitable, but they have a valid, and vested interest to do so.
Howdy Doodly Doo!
Anybody want some Toast?
As a mail administrator for a medium size company I've had to deal with residential broadband ISPs blocking access to port 25 a lot lately. It was a headache explaining to employees that work at home, at the office, and at customer sites, that they must change their outgoing SMTP setting in Outlook depending on their location. This is a true PITA as lots of times your not supplied with that information (or at least it is not obvious to the non-technical people), for example, internet access in hotel rooms.
For a while the quick and dirty solution was to use webmail when in doubt but we needed something that people could live with and as much as I dislike M$ Outlook its a lot better than Horde, Neo, or Sruirrel Mail (IMO).
My 80% solution now is to handle SMTP on both ports 25 and, hehe, 26. So far so good, I'm able to go between the office and home on my laptop with no problems where as before Cox Cable wouldnt let me get to our SMTP server.
I'm wondering what other admins have had to do in this situation. I know I'm not alone here. And how do you think it will effect the propogation of spam in the future.
Im dreaming ofa big bndwdth, That can resist the
Attacking the source of the money--that, I believe, is the only way to kill spam.
That's why I run Unsolicited Commando. It fills the inboxes of companies that pay for spam with spurious form fill-outs. I guess it's kind of like giving them a taste of their own medicine.
Help find a cure for cancer. Join the [H]orde
The California law made the "beneficiary" of the spam responsible for it. And anybody could sue. That would have made hiring a spammer very risky.
Broadly defining the "beneficiary" could go even further. The credit card service provider, and the bank behind them, could be held responsible for spam if they processed a transaction resulting from spam. They profit from it, after all. A good lawyer could make the case now that they bear some responsibility, especially if they assist in any way in concealing the identity of the spammer.
We really need to go after the payment end of spam, not the sending end.
While the authors say the target audience includes "ISPs and mailbox providers", the list of recommendations reads like a wishlist for large ISPs and email hosters. These are the things that hotmail, yahoo and earthlink want us to do so they don't get as much spam. There is very little in there recommendations that will help me get less spam. If I could use spf to know where hotmail, msn and yahoo send mail from, I'd be able to reject 30% of the spammy organization recieves. This isn't on the list of recommendations, although aol, earthlink, and gmail all do publish spf records.
It's very hard for any mail administrator to block mail from these large domains, because so much of the legitimate mail comes from their actual servers (wherever these are). I'd be happy to reject all mail addresses from msn.com or yahoo.com, but my users would see a huge increase in false positives. It's a no brainer to drop messages addresses from dailyoffers.com because I don't see any legit mail addresed from this domain anyway.
Have you ever seen any GOOD spammer behavior?
As a matter of fact, yes.
Some of them retire.
Or die.
This was just a bunch of fluff. I was hoping for some meat. The big ISPs have enough clout that if they force the issue of good practices everyone will have to adapt and the people who will have to adapt are those with broken non-RFC compliant servers.
Best practices can encompass the RFCs and extend them to, well, best practices.
For example:
Per RFCs every place a domain is used it must be fully qualified and resolvable. In addition, the EHLO is supposed to be the primary hostname of the sending machine.
Anti-spam best practice might say that the machine name must resolve back to the connecting IP. Even better, the reverse entry for the IP must include the correct hostname. This way a receiving machine can determine who the sender claims to be, that the DNS entry for that name matches the IP (anyone can spoof the header but it's lots harder to get to the DNS of a legit operation) and that the reverse DNS shows the correct hostname (which would be harder on those who have low-end connections where they don't have control over the reverse DNS entries but no problem for most IT operations - anyone with a small operation can send through their ISP anyway).
If the major ISPs required just these items to match there would be a brief period of pain while everyone scrambles to fix broken systems but the gains from stopping viruses and spam would be enormous and tracing back to and blocking the remaining spam would be easier.
I also saw nothing about information sharing among the large ISPs so they could quickly act against a spammer or quickly disable the web accounts to which the spam is directing people (carefully, of course, or fake spam could be a means of a DOS attack).
Similarly, there was no mention of blocking email where the from address doesn't match the ISP. A couple years ago I dealt with massive backscatter from spam sent by an Earthlink customer THROUGH the Earthlink server. I tried to get an answer from them on why they were allowing someone to send out email "from" our domain when they have no relationship to us. Silence. Sure this is a pain for some people but people who want legitimate extra services can sign up for them. It's not so different than paying for a static extra IPs. If you want to send from a different domain we'll unblock it for you for a small monthly fee after determining that you are authorized to represent that domain.
This just scratches the surface but all in all this "best practices" is a joke.
~~~~~~~
"You are not remembered for doing what is expected of you." - Atul Chitnis
One major question anyone reading this has to ask is -- what constitutes a "legitimate need" to run a mail server (people meeting this condition are those who ISPs should open port 25 for, according to the official doc). I run my own mail server, and have since 2000; additionally, I give out accounts to any of my friends and family that want them. The reason I do this, and the reason people get accounts on my box, is the lack of (unreasonable) restriction I impose on them: no mailbox size limit, no outbound mail size limit, as many aliases as they feel like (of course, I don't run an open relay, and I'd cancel an account instantly if I found someone spamming through it). If I were forced to move to some hosted solution, I would lose a lot of features, and have to pay to boot.
So is it necessary for me to run a mail server? No, I could technically survive without my own. Would it be a travesty if I were forced to switch to cut off spammers? Hell yes!
So until they draw the line on who "needs" to run a mail server, I can't possibly support this concept (or at least the port 25 restrictions piece of it).
How To Get Humans To Mars