Slashdot Mirror
Spammers Are Early Adopters of SPF Standard
nazarijo writes "In an article entitled Spammers using sender authentication too, study says, Infoworld reports that a study by CipherTrust shows that SPF and Sender ID (SID) aren't nearly as effective as we expected them to be when combatting spam. The reason? Spammers are able to publish their own records, too. 'Spammers are now better than companies at reporting the source of their e-mail,' says Paul Judge, noted spam researcher and CipherTrust CTO. Combined with low adoption rates of either SID or SPF (31 of the Fortune 1000 according to CipherTrust), this means that the common dream of SPF or SID clearing up the spam problem wont be coming true. Wong, one of the original authors of SPF and a co-author of SID, says that it was never intended to combat all spam. Weng, another researcher in the space, says that this is just one of the many pieces of the puzzle needed to combat spam. Various SID implementations exist, including a new one from Sendmail.net based on their milter API, making it easy for you to adopt SID and try this for yourself."
OK, We need to change SMTP completely. It was created back when the internet was somewhat new, and spam e-mail was unheard of. The protocol itself needs a change.
All we need to do is block emails from anyone using SPF or SID.
I once had a signature.
need sun protection
Idiot. The point of Sender ID systems is to make it easy to track down spammers and enforce spam laws. Sender ID isn't meant to stop spam like spam filters or sender payment schemes but make laws enforcable.
Isn't putting up SPF records exactly what we want spammers to do? If they've got SPF records, running an RBL against spam domains should be easier and more accurate.
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
The principal author of SPF is Meng Weng Wong. Just one person. Doofus.
Spammers are like viruses, they adapt amazingly fast. You thought that this new technology would hinder their 'business', but they turn it to their advantage! Oh look, a valid sender ID... i'll just open this mail, it can't be spam, right? Right?
Oh well, at least filters are getting VERY good at catching 99% of it.
Eureka Science News - automatically updated
Understanding SPF as I do, I can't see how any one expected this "end the spam problem".
;)
It'll cut down on problems where forged senders are the main symptom, dramatically. That both includes viruses ( virii ) and some spammers.
But, as is stated, it's completely possible for spammers to keep their dns records updated too.
Now, if only we could get the whois accurate.
Mod me down with all of your hatred and your journey towards the dark side will be complete!
This is certainly what was expected by everyone I've discussed this with!
What it does end is domain spoofing (joe jobs), and it adds a level of accountability. If spammers are using their real domains, great. We go to their registrars, most of which have anti-spammer policies, and we get it yanked. If it costs the spammers money, it's a good thing.
The point of SPF was not to eliminate spam, but to eliminate spoofing. If successful, this is enables effective and cheap spam filtering by forcing spammers to use domains that can easily be blacklisted.
In other words, SPF is working correctly, brighter tomorrow expected, move along, nothing to see here.
Liberty you never use is liberty you lose.
License it from your government like a passport.
It would allow the officials to track down paedophiles, drug-dealers and spammers. No drawbacks, except that if you're living in China you might run into trouble for sending certain kind of e-mails but that's China's internal business (and don't you dare to give me that "let freedom ring"-crap).
despite backing from software giant Microsoft Corp
---
I give all products an objective and just comparison (based on their names)
*sigh*
In theory, when all spammers are forced to publish SPF records, along with all legitimate e-mail senders, it will be easy for legitimate companies to develop e-mail reputations for Internet domains that do and do not send spam, he said.
So it'll be just like the RBLs we have now, only you won't be able to send work email from home?
SenderID is not designed to combat spam (although many uninformed individuals think it is), it was designed to fix a fundamental problem with the E-Mail system.
You can not guarantee that an E-Mail originated from the source it said it did.
Which effectively makes black-lists useless.
With SenderIDs you are able to build effective Black-Lists/White-Lists because you can guarantee that an E-Mail came from the location it said it did. And thus decrease the amount of spam.
I'm not sure who wrote this 'study' but the fact that I know more than them says a lot.
I have found SURBL - Spam URI Realtime Blocklists to be pretty effective the last while. While everything else is forged and loaded with junk text the actual links back to spammer web pages have to be at least partially valid.
... to declare open season on spammers.
.. have no balls... .. fucker"
"What good is Viagra if you
Norman Cook's Ode to Sl
I actually tried to set up SPF for my site this morning after reading another /. article. Turns out my DNS provider does not support TXT records and gave no indication of a willingness to do so. If it turns out that SPF and some other combination of technologies will prevent me from getting spam as well as prevent my email adress from being spoofed as the From: address on spam sent to others, i guess register.com is about to lose a customer.
The difference between Canada and the USA is that in Canada healthcare is a right and gun ownership is a privilege.
If spammers are now forced to identify themselves in their emails, by means of having a domain and publishing SPF records for that domain, then good.
That was the entire point.
In combination with anti-spam laws, now we have the ability to actually identify the spammers flooding our inboxes and take legal action against them for doing so.
There is no technological means that will allow random people to email you and yet prevent them from emailing you spam. Technology is simply not capable of distinguishing spam from non-spam with a 100% success rate. We can get really close, but there will always be false-positives and false-negatives in any system. And any system is vulnerable to clever hacking around the filter. You can make it terribly difficult to do so, but you can't make it impossible.
The goal of SPF never was to stop spam, it was to force somebody who sends you email to be accountable for doing so, by providing a method to track down who they are. At least, it's a good start for this sort of thing.
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
"Destroy science and religion. Science would re-emerge exactly the same; but not religion." - Penn Jillette, paraphrased
... that there's finally a broad consensus about standards adherence.
SPF doesn't and can't block spam.
it has a different purpose. it prevents some email address forgeries. its main use is to allow a domain owner (e.g. an individual or an organisation or a corporation such as a bank) to specify exactly which hosts are allowed to send mail claiming to be from that domain.
in other words, it can be used to block forgeries such as phishing spams and viruses, but it is not a general purpose spam blocker.
it does that job reasonably well (or, it will when it is implemented by enough mail servers). to complain that it doesn't do a job it was never designed to do is just absurd.
Prevent email address forgery. Publish SPF records for y
So that's it??
:)
Any chance that "Wong", "Weng" and possibly "Wang" and many others are all really one person?
The department just create new names to make themselves look big
Then again, I seriously doubt it is meant to fix anything, it is just to create a new intermediatary so that we will have to end up paying them.
Constantly paying and paying, can't run away from it in Corporate Amerika!!
Online backup with Mozy, sounds like Ozzie, but more!
... to spam is fear. Fear is brought on by threats of imminent bodily injury backed up by action. Chairman Mao was right: Power comes from the barrel of a gun.
Technological measures have not worked. Legal measures, where they exist, have proved worthless. That leaves the tried-and-true vigilanty method.
If you believe you will get the holy living crap beat out of you for doing something, chances are considerably less that you'll do it. Ask any abused child. Half a dozen broken kneecaps and dislocated hip joints on the bodies of half a dozen well-known spammers just might do a world of good.
Nothing else does (he says as he dumps his 100,000th spam of the day).
The only real way to combat spam is to also stop sites and spammers from selling email addresses to each other. If the spammers don't have their most precious commodity, they can't spam.
SPF can be circumvented in the ways we're already seeing for the first category, but it should knock out the second two (and probably related) problems.
As for the final one... law enforcement may still not take phishing seriously. But I bet Citibank, US Bank, et al do. They're probably losing millions of dollars cleaning up the mess left by phishers, and that money would go a long way towards making phisher's lives miserable and cautionary tales for others. These organizations are large enough that phishers can't even hide behind international borders - piss of Citibank by protecting phishers and that bank may decide that it's not worth doing any business in your country.
For every complex problem there is an answer that is clear, simple, and wrong. -- H L Mencken
How could anyone possibly have thought SPF would reduce spam in any way?
.mail scheme from Spamhaus, where the registrar controls your DNS records.) Only insane people will tolerate that.
No system that is under the technical control (like SPF) will reduce spam, since the spammers will simply comply. In the case of SPF, all the need do is add in a new section to the script they use to automate signing up for dozens of new domain names at a time, to add the SPF records. (These scripts already add in the other DNS records, so this is trivial.)
And no system that is under the control of someone other than the domain holder will ever be used. (Like the
The solution to spam involves dark alleys and cattle prods, not wacky technical solutions that won't do anything.
Second, I'd have thought that it would be obvious that trivial authentication would be useless. It's like using the existance of an X.509 certificate as proof that a site is genuine, notwithstanding that anybody can download a roll-your-own certification program and generate their own.
Third, it's ironic that corporations (who lose millions, if not billions, to fraud each year) aren't the least bit interested in authentication of any kind, whereas spammers (who probably make a very livable income from fraud) are adopting it in droves.
This last one is the most bothersome. Many (but by no means all) corporate websites use SSL for credit card info, but that's about it. And even then, usually only the server has a certificate. Client-side authentication is extremely rare.
Even for business-to-business networking, where you would have thought it very important that both ends of the connection are who they say they are, it's extremely rare to find even the most basic of security measures. IPSec? Kerberos? Nah. I've worked for companies - and even Government agencies - that were quite confident that their
It's a sad day, when the only e-mail you can be sure is genuine is the e-mail that's pure crap.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
... that wong was wrong all along. So long.
Norman Cook's Ode to Sl
it's your own damn fault when you cut your finger.
I don't want knowledge. I want certainty. - Law, David Bowie
The only reasonable spam solution is email acceptance rate limits by the major email routers.
A zombie PC will rapidly move from a low emmission of emails to a much more rapid rate. If the upstream email routers rate limit email transmission based on historical information you strangle the spam at source.
Spam isn't eliminated, but it's seriously limited hopefully to the point where it is
unprofitable.
All other methods do not address the major characteristic of spam, the large number of emails and the very low response rate.
Slightly OT perhaps, but for the life of me I don't understand why everyone gets so upset about spam. Don't get me wrong.....I hate having to delete all the spam I get, but it's nothing compared to the physical junk mail I get in my mailbox. I think that's twice as annoying as spam.
With spam, I select some messages, hit delete, they're gone. With junk mail in my mailbox, I have to haul it from the mailbox to the trashcan, sort through it to make sure nothing is real mail I actually want, and throw it away. It wastes paper, it fills up waste recepticals faster and IMHO, far more annoying than spam.
Yet it receives far less attention.
But that's the point isn't it! Its to stop spammers hiding behind faked addresses. If they publish proper SPF records then the spammer black list catches them.
If they fake their address to a domain publishing SPF records then the SPF check fails and the message gets flagged for aggressive filtering them.
Either way they're screwed.
Wait, wait. SPF prevents you from sending an email from one domain with a different @domain.com?
I have a university e-mail address that ends with @msstate.edu. But I don't live on campus, I live in the surrounding town and so am not on the msstate.edu domain. My SMTP host is nctv.com.
Right now, I can just set up my mail client to use email_address@msstate.edu and send it through nctv.com. Will SPF prevent me from doing that and force me to use webmail or something equally inconvenient?
WeRelate.org - wiki-based genealogy
Just imagine we manage to kick the spam out of the internet with this temporary fixes, what happen next? I bet we'll get sloppier or disable the filters as they are so effort and time consuming. And them the spam will kick in again.
Folks. We need a definitive solution, not temporary patches.
Two of my domains are used in the from address of spams, to the point that I often get thousands of bounces per day. This is the "reward" for years of turning spammers in and getting them tossed from their ISP's.
These sender id schemes won't stop spam at all. It's easy for a spammer to modify his dns to show the correct records and allow him to send.
But, here's the thing: HE DOES IT TO HIS OWN DOMAIN. We can then blacklist his domains and force him to keep coming up with new ones. Whack-a-mole, yes, but at least the "moles" aren't at legitimate domains.
You can complain all you want about how this isn't going to stop spam. Maybe it won't for you, but it will cut down the worthless junk hitting my mail server.
Do you have ESP?
'nuff said.
However, once SPF is adopted it allows several things:
I fully expect the anti-spam vendors to eventually come up with reliable whitelists based upon SPF eventually.
to complain that it doesn't do a job it was never designed to do is just absurd.
Wrong. To complain that it doesn't do a job it was never designed to do is just Slashdot.
Terrorists can't threaten a country's freedom and democracy. Only lawmakers and voters can do that.
I had my couple of domains at register.com which increasingly sucked. This was the last straw, and I finally switched over to pairnic and I've been much happier. Although I haven't gotten around to setting up SPF yet, they *do* let you set arbitrary TXT records.
Then comes the blacklist of senders, so spammers can't send emails as joe@microsoft.com and instead have to send emails as joe@viagra4less.com and then you can just block viagra4less.com :)
I admit that a spammer signing up for domains using zombied proxies and fake contact info is going to make it difficult to track 'em down that way. But you really have to take on one problem at a time, here.
You might consider bitching at the registrars and the system that allows somebody to buy a domain name with fake, unverified information and stolen credit cards. Something really should be done about that as well, don't you think?
- Give a man a fire and he's warm for a day, but set him on fire and he's warm for the rest of his life.
Basically you end up only accepting mail from known trusted domains. If you are just starting a domain then your mail may be held up or even bounced by some users. Just as new car drivers get higher insurance so can new email domains have to pay in boun
Slashdot, home of supporters of free software, free music, and free speech.Except for Moderators that disagree with you.
People who expect the Internet to be place of order will die unhappy.
SPF is not an effective anti-joe-job mechanism either. I have posted analysis (very negative) of SPF's anti-spam and anti-joe-job capabilitites to Slashdot before.
.5, he trusts this person .1, so I trust the second person .05, which is above my threshhold of .001"), and some form of feedback mechanism ("This person spammed me so I trust not only him not at all, but the person that trusted him less") you have major benefits -- you have carry-over reputation ("Linus just got a new email address, but it's endorsed by his old email address") and the like. Futhermore, you can have a "company postmaster" PGP key, which is used to sign keys of employees at a company, so when a large company opens a business relationship with that company, it just has their own postmaster (which their local users trust) sign the key of the other postmaster.
The reason SPF isn't good at anti-joe-jobbing is that there is no trusted map for users between a domain name and a company identity. If I send an email from @boa-international.com or @bankofamerica.banknetwork.com, end users won't consider the fact that it doesn't come from @bankofamerica.com. SPF is fundamentally tied to domain names. Furthermore, SPF has only domain-level granularity, which means that the larger the company, the weaker the anti-joe-job factor. It just takes compromising one computer anywhere at Ford to be able to send trusted "Ford official customer service" email.
SPF is (a) not a good anti-spam mechanism, and (b) not a good anti-joe-job mechanism. It is a very weak and fairly broken authentication scheme. It lacks trust management (despite the fact that the SPF people admit the need for trust network management). There are known attacks on SPF that will beat it, like the fact that it rides on an easily spoofable protocol (DNS) and does not attempt to establish a secure connection on top of it.
I'm not saying that PGP is ideal, but it could be used to provide a foundation to build a strong, effective anti-spam mechanism that doesn't suffer from SPF's flaws.
Note that Microsoft's Sender ID largely suffers from the same problems as SPF.
Yahoo's Domain Keys is actually somewhat better built (provides for a more sane delegation of mail server authority, and so forth), but still is a fairly inflexible and ineffective system.
Designing secure systems is very hard, no matter *how* good at it you think you are. It took a *long* time to get SSL reasonably mature and free of attacks. Throwing out a system like PGP which *is* mature, well-tested, well-built, flexible, and in favor of something new hacked up is really not a very wise decision.
That doesn't mean that we should just take PGP and whitelist people that you know (knowing that someone's identity is correctly associated with their email address is a different thing than knowing whether they won't spam you), but if there are flags like "authorized to authorize people as legitimate email parties", non-boolean trust metrics ("I trust this person
May we never see th
spamassassin/trunk/rules/50_scores.cf says it all right here:
;)
#
# SPF
# Note that the benefit for a valid SPF record is deliberately minimal; it's
# likely that more spammers would quickly move to setting valid SPF records
# otherwise. The penalties for an *incorrect* record, however, are large.
#
ifplugin Mail::SpamAssassin::Plugin::SPF
score SPF_PASS -0.001
score SPF_FAIL 0 0.000 0 0.875
score SPF_SOFTFAIL 0.500 0.842 0.500 0.500
score SPF_HELO_PASS -0.001
score SPF_HELO_FAIL 0 0.405 0 0.001
score SPF_HELO_SOFTFAIL 0 1.002 0 3.140
endif # Mail::SpamAssassin::Plugin::SPF
Sendmail doesn't give points for giving a hostname that resolves. However, it rejects the connection when the hostname doesn't resolve. Same thing here.
law enforcement may still not take phishing seriously. But I bet Citibank, US Bank, et al do.
And you might actually lose that bet. I received a "phishing" spam allegedly from CitiBank, and when I tried to send it on to spoof@, abuse@, and postmaster@, I got three very curt, very automated replies informing me that "an email you sent to us was blocked from being delivered because it appeared to be spam". Well, no shit, you geniuses. At that point I decided that I'll simply delete any further CitiBank "phishing" scams I get, and CitiBank can go pound sand. Good thing I'm not (and won't ever be) a customer of theirs.
"I feel that if a person can't communicate, the very least he can do is to shut up." -- Tom Lehrer
Porn is always at the cutting edge of every media. Quite a bit of the spam is for porn so it is no suprise to see spammers adopt a standard before most everyone else.
FoundNews.com - get paid to blog.,
Posted as AC! I love it.
That's up to the DNS admins of msstate.edu. Their domain, their sender policy. SPF merely allows them to express it in a way that remote MTA's can parse and check.
The power of SPF is not in it's ability to authenticate senders, but in a domain owner's ability to specify who is allowed to send mail from their domain.
If you accept without question mail from SPF verified senders, you're just asking for trouble. There's not and has never been anything in the SPF standard the recommends this practice.
However, If you reject mail based of the SPF records of the sending domain, you can make a difference. If ticketmaster.com does not want mail sent from anything but their mail servers, then by rejecting all ticketmaster mail from other servers, you are reducing spam with forged headers.
It is not possible for a spammer using a domain owned by somebody else to "fake" the SPF records, since they are contained in the zone file for the domain itself.
Please send all UCE to scally@devolution.com so I can f
The number of idiotic posts here is just another example of the declining clue of slashdot users. SPF is an attempt to prevent email forgery. Lots of spam is forged, in an attempt to get by filters. More serious trouble is caused by various 'fishing' schemes, trying to get your bank account/credit card numbers by appearing to be from paypal ,etc. SPF will address the forgery of host &domain names. It does not address the problem of forged user IDs (though this is less of a problem than you may think, if the domain is legit). It does not address the idea of unwanted mail.
Anyone with clue can see this is another tool in the toolbox. Each piece of incoming mail is ranked with a score indicating its probability of being spam. SPF, whitelists, bayesian filters, being in html, coming from china, etc affect the score. There's no magic bullet to stop spam.
Anyone who has spent time as a systems admin of a mail server, should know this.
There's a solution (which I use for my domain): msstate.edu's mail servers need to turn on authentication (hopefully with SSL), and allow your mail to be relayed if it is authenticated.
Then tell your mail client to route all mail through smtp.msstate.edu (or whatever their SMTP server is running on), and presto! The outside world will see mail come from an SPF-authorized msstate.edu mail relay, with an @msstate.edu sender.
Now, if msstate.edu turns on SPF and *doesn't* turn on something like this, then right, you're screwed. But in that case, it's because SPF isn't being set up properly, it's not because SPF is inherently broken.
Spam is here to stay. You cannot stop it. I've been an avid user of email and the Internet for years now and ya' know how much spam I get in my mailbox? 4 or 5 messages per day. And these only blink in my inbox as Thunderbird (or Outlook with SpamBayes) quickly relegate my spam to my junk folder. Every email that ends up in my inbox is legitimate email that I want to receive. And even if it's not, one click and it's gone and my filter just got smarter.
Yes, this doesn't cut down on the congestion on the internet, but as a free and public network, you cannot hope to contain it.
Also, be sure to practice smart internet usage. Have throw-away email accounts, only supply your email when it is absolutely necessary to do so.. Don't be willy-nilly about it all and you'll be just fine!
What is your penile percentile?
already taken.
mefus
In Open Society, GPL Software frees YOU!
Please read about SPF and then get back to us. It has nothing to do with corporate america.
But on the whole, technical solutions are just treating the symptoms. There is only one, and one only way to remove spam, and that is to make it illegal. Its a DDOS on an essential communication medium; so put the Patriot act to some good use and have it labelled "terrorism", the very same as if some group hijacked a TV station.
Having done that, follow the money trail, which should lead directly to the spammers and their (often unsuspecting) clients. They have to store the money in a bank account somewhere. If that bank wants to keep doing business with or in the USA or Europe, they will freeze and seize, and spam goes from a relatively low effort marketing scheme to a very unprofitable criminal act.
Yes there will still be spam, but the nature of the web means that everything can be tracked. Email especially. And please forget whitelists and blacklists, I'm not answering to some self appointed body as to the validity of my emails.
What he can't kill, he has sex on. Trent.
Spammer Promoted First
SPF is only the first step. It's purpose is to authenticate that the sender is who they claim to be. Nothing more.
This primarily helps in two ways: first, it helps fight off certain kinds of social attacks. E-Mail can't claim to be from your bank; if it does, the MUA would display a big warning box stating the mail appears to be forged.
Second, it guarantees that people can't spam or send viruses using your domain name. The spammers have to (just as the article says) identify who they are; they can't claim to be someone else.
So no, obviously, that doesn't stop spam. It might block certain kinds of (soon to be obsolete) spam. You no longer have to blacklist all of aol.com, for example, since only real AOL users could send mail from @aol.com if we all used SPF.
This does, however, make it possible to do *MUCH* more accurate RTBL (Real Time Block Lists). The spammers have to identify themselves; once you have their identity, block all their mail. You got spam from @spammer.com? Block spammer.com. The guy at spammer.com can't pretend to be anyone else, so you've got him successfully blocked. Sure, he can register multiple domains, but with a good RTBL that isn't too much of a problem. Good RTBL already block most of the registered spammers - SPF makes their job easier since all spammers will be identifiable.
Mix SPF with a RTBL service and you *will* see a massive drop in spam. Over 80% of all incoming connections to my mail server are now blocked; most of the stuff that does get through is legit (lots of large mailing lists and traffic).
We need a micropayment scheme for email. Friends in your contacts list (whitelist) send for free, unknowns get autocharged a minimum (like $0.01), blacklisted spammers get charged more (like $5.00). Putting the payment into the authentication transaction between servers will let us continue to use the same client software, with upgrades only to servers run by admins.
That system will discourage spammers, who get us to pay for their abuse, but would have to pay more than their low-yield spams are worth, across thousands of targets. And it will also establish an infrastructure for simple ecommerce. We can turn the debacle of spam into a triumph of distributed postage.
--
make install -not war
If SID is supposed to be the Caller ID of email, then isn't spammers adopting it a GOOD thing? Doesn't that mean that somebody can create a list of the SIDs of spammers, providing a super-effective spam filter for a mail server that only accepts SID identified mail?
Thats no so surprising really. At best, SPF and other technical solutions can buy us some time while the spammers catch up, but they aren't the silver-bullet that their designers make them out to be. Even the RBLs and bayesian filters only go so far to cure the problem. Such systems only buy us time - in this case maybe 6months or up to a year, as the spammers catch up to the technology and find ways to avoid it. Bear in mind that these people are very well-funded and therefore highly motivated.
With the abundance of "always-on" network connections, and the insecurity of those systems always connected its still easy to generate and send huge quantities of spam.
Second, it guarantees that people can't spam or send viruses using your domain name. The spammers have to (just as the article says) identify who they are; they can't claim to be someone else.
:)
To pick nits: actually they can claim to be someone else--they just can't claim to be you.
Yes, I agree tat something must be done. No, I don't agree that should be an argument to allow submarine patents to become a fundamental part of the core Net infrastructure - that will go a big step to creating the exact have/have not divide we've been trying to prevent. The same problem exists with payments - how are you going to make sure such a payment does not encumber nations with low GDP from sending normal messages?
And no, I don't have any answers either other than RBL + greylisting seems to be a start, together with Vipul's Razor concepts.
BTW, I've seen some people proclaim that spam is not a problem because they only receive a few a day. I have to suffer some extreme cluelessness in the IS department in my company who send back a message "Potential spam" - nicely confirming an address is live. And believe me, that's helping. The spammers, that is: since the idea my spam count has gone up from 95 to a good 150 or so. Sigh. Belive me, at that rate it most certainly is a problem, especially on a Windows platform with Outlook and Exchange, even with SpamBayes installed and well trained.
Insert
to complain that it doesn't do a job it was never designed to do is just absurd.
/. the pro-SPF people were doing the "just" thing:
It is not absurd to complain as a "we told you so" to the pro-SPF faction that would go on and on here about how fucking great SPF was. Every single time there was a discussion of spam on
If everyone would just adopt SPF the world would sparkle like a shiny new dime and spammer will be a thing of the past.
The anti-SPF people (I believe 0x0d0a had some eloquent anti-SPF tracts here) were the ones in the past who would point out that SPF wasn't designed to stop spam, not the pro-SPF people - so they can't have it both ways.
I say we ban the "just [do simple thing X to solve massive non-trivial problem Y]" form from all discussions and ban SPF from any anti-spam discussions in the future.
That would solve the problem for both sides - the pro-SPF forces couldn't yabber on about SPF when everyone is trying to find real solutions and the anti-SPF forces woudln't be accused of saying bad untrue things about what SPF doesn't do that it wasn't supposed to do.
Who could have imagined, spammers actually adapting their methods to what recent developments in technology allows them to do? Wasn't the idea that every legit user should upgrade their e-mail software to something new, leaving spammers to pound sand..?
I'm not at all impressed by statements that SPF or whatever is just one of many changes needed before we will get rid of junk e-mail. Give us the whole plan at once and let us scrutinize it in detail before deciding whether to employ it; don't hint at a potentially infinite number of steps, disclosed one by one, that need to be taken (each step at substantial cost to the Internet community) before we will eventually reach non-spam nirvana.
Sender Permitted From: It breaks forwarding, we can work around that by rewriting sender addresses at each MTA, but regular users can still send e-mail, and so can the spammers.
Accept only digitally signed messages: We make it really easy to send signed mail, so that not even your grandmother will be left out. Don't worry about the spammers getting a free ride off your labour by using the same tools; they have learned to sign their ads before you start filtering out unsigned messages.
Replace SMTP: Sure, but with what; CMTP (Complex Mail Transfer Protocol)? Will it allow the transmission of mail? Then it will allow the transmission of junk mail, too.
Have the sender pay CPU time for each message: Granted, this probably will cut down on the amount of mail you get, in particular from the vast majority of poor senders out there. Those who have a business incentive to invest in computing power, or won't hesitate to steal CPU time from others, won't suffer as much, but they constitute a minority, just like the spammers do. Remember, it's just one small step towards... something.
Require that no mail must contain the word "viagra" (or any other word in an arbitrarily defined dictionary): Care to put that in an RFC, so that we can have also the MUA refuse to send a message with banned content? I guess spammers will be happy to use precisely those banned words, in order not to have their mail delivered to anybody.
In short, you can add as many components to your junk mail prevention system as you like, but it's not going to get you one bit closer to your goal, unless you focus on what really distinguishes unwanted mail from wanted mail, and invent a mechanism for automatically telling the two apart. Any other step will be a pointless distraction, as it merely begs to be circumvented.
SPF does not, however, eliminate spam. Sorry.
The World Wide Web is dying. Soon, we shall have only the Internet.
The reason? Spammers are able to publish their own records, too.
From the moment SPF was implemented, people knew that this could happen. SPF doesn't aim to stop spam outright, it aims to HELP stop spam.
First off, if SPF is used, it cuts out 'joe jobs.' I can't send you mail purporting to be from Yahoo through a mass mailer on my desktop, because SPF will catch it.
I see two issues with spam:
a.) Annoying commerical advertisements
b.) The above, sent fraudulently
SPF helps to cut out the second. If spammers send me spam, but do it from their own domain, it's still not hard to block them.
No one (that knew what they were talking about) ever claimed that SPF was a cure-all for spam. All it aimed to do was make spammers stop forging their addresses. And it sounds like it's succeeding.
________________________________________________
suwain_2
Do you even know what a joe-job is? Look it up, SPF prevents joe-jobs because a joe-job is where you spoof the domain. Spoofing a domain that looks like another domain is not, by defintion, a joe-job, you fucking idiot. If my domain is lastname.com and spammers start sending email with a spoofed evelope that says "lastname.com" anybody who is SPF aware will just discard the message.
http://www.joes.com/
Or you can have your SMTP envelope sender be whatever@my-ip-provider.net, but set the From: header to me@somewhere.edu; or, failing that, there's still the Reply-To: header.
I guarantee you that a lot of the emails being identified as "spam" by the filter is marketing content that quite possibly is of interest to the intended recipient.
A lot of companies send email that looks something like spam but which probably isn't. Looking like spam while not being so is easy - just send solicited marketing email. (Spam filters identify spam by the fact that it looks like someone is trying to sell you something.) If you're in that position, then being identifiable is good - it helps people create working blacklists or whitelists, and you think that you'll be on the whitelists.
In fact this early in the adoption curve I'd suspect that virtually all of this "5% of spam" comes from at least somewhat legitimate companies trying to get whitelisted. After all anyone who doesn't see themselves as legitimate has no reason to try to identify themselves. Why make yourself an easy blacklisting target? By contrast people who see themselves as sending clearly legitimate marketing email have every reason to take any steps which help Yahoo etc whitelist you.
In fact legitimate emailers actively want everyone to be identifiable. The easier it is for you to filter out obvious garbage, then the more likely it is that you won't filter overly aggressively and drop stuff that you asked for and presumably want. Things like your Amazon.com invoices. Balance statements at PayPal. The product review newsletter that you signed up for.
Disclaimer: I work for a company that is in exactly this position. Here is a summary of the business. People sign up with us to search for apartments. (We do not buy or sell email addresses. In fact doing so would be business suicide because we would immediately be identified as spammers and rightly get blocked. In addition the programmers would all quit.) If you find one through us, then the landlord owes us a finder's fee, and we owe you $100. Both of us want you to find an apartment. To help you, we'll send you emails with lists of properties based on searches that you did on our site in the hope that you'll find a home.
We know from experience that those targeted emails find a lot of people places to live. Therefore we want them to get through. Judging from the feedback that we get, the people who sign up generally do as well. Unfortunately the spam filters in the way can't tell whether the email is wanted - all that they can see is that there are phrases which look like marketing and therefore it looks like spam. But if we make ourselves identifiable and work with ISPs, the feedback that they get from their customers tells them that we're really not spam after all. And then we can get through those filters.
There's... ohh, you know. An unlimited amount of domain names you can have. Spammer sends out a few spam "campaigns" and simply changes domain names, SPF and all.
It won't help anything. Many of them will use stolen credit cards, or register under other false information, register 300 domains, and use them until they are blocked. Then move on.
So the problem of scanning each and every e-mail for spammishness will still prevail.
- It's not the Macs I hate. It's Digg users. -
"Having to madly swap domains to get is only going to swamp smaller spammers with enough extra cost to kill them."
Great! Fewer spammers is a Good Thing (TM).
There isn't any single solution to spam. But different solutions will whittle the big problem down, bit by bit.
That is what I think the already very good approach. I don't think antispam research very useful or needed (those NLP/statistical shit).
Your method is too brittle.
Suppose you work at a company. YOU might be perfect, but SOMEONE is going to make a mistake. And over time, more people make mistakes. They end up on spammer's lists.
I don't care about how efficient your client filters are. The messages STILL need to arrive and they STILL take up bandwidth.
Given enough spammers, the T-1 my company has will be flooded. This will become a DDoS via eMail.
You're looking at the problem for your single-user perspective. I'm looking at the problem from the network administrator's perspective. I see the bandwidth lost from spam. I see the disk space consumed. I have to put in additional hardware just to handle it.
Spam will be around as long as it is profitable enough for the low-lifes.
SPF is the first step in reducing the profit from spam.
It will not stop spam, but it will kill some of their practices.
It's not a replacement for RBLs, lusr. RTFM!
SPF is not patent encumbered. Sender-ID is, but you'll notice I wasn't referring to SID. I highly dislike Sender-ID for quite a few reasons, not the least of which is the patent issue.
"The spammers have to identify themselves; once you have their identity, block all their mail. You got spam from @spammer.com? Block spammer.com. The guy at spammer.com can't pretend to be anyone else, so you've got him successfully blocked. Sure, he can register multiple domains, but with a good RTBL that isn't too much of a problem."
The next step would be to match those domains with IP addresses.
You'll see the pattern emerge of which ISP's are "spam friendly".
We need SMTP whitelisting. It is the ONLY way. The SPF scheme kinda-sorta-maybe promised this idea in a mellow way that didn't seem invasive, but like all the other ineffective anti-spam measures, it has proven to be useless.
We need a responsible central authority to maintain an authoized SMTP relay whitelist - "outbound mail server licenses" per se.
This is the ONLY way. Mark my words. No other solution will EVER work. Anything that comes close is basically a veiled attempt at SMTP whitelisting.
If you want to send e-mail on the Internet, you need to be "licensed". A central authority determines the standards by which you are allowed to be "whitelisted" - other systems on the net can choose to use or not use the RBL/RWL. I for one, would use such a system if it were responsibly maintained.
This is so easy to set up. Take all the DUL IP space and instantly blacklist it, then blacklist based on reports, and then start to require "relay licensing" before you can be whitelisted. It WILL HAPPEN eventually. The question is, how bad do things have to get before this is adopted. It's not a question of "if" but "when". There is NO OTHER WAY. Not a single method has proven more reliable than using relay blacklists. Right now, 95% of spam can be reliably blocked without wasting bandwidth by using RBLs. A whitelist would be even more efficient. I challenge anyone to show me any better way to control spam. There is none.
For those of you reading this that don't understand the mail system, you need to understand one important thing. The spam problem could have been solved years ago. There is a very simple technical/organizational solution. Lobby your ISPs to adopt relay whitelisting and this problem will be gone. The only other method involves getting law enforcement to enforce the laws that spammers break, but I think it's easier for the industry to implement whitelisting than to try to get politicians to enforce the laws.
Quarantine emails from domains that you've had little email from for more detailed analysis.
It makes getting a new domain started harder, but kills the problem of "drive by domains" if you have a large sample of emails to start with. There are other ways to organize whitelists for smaller domains to use.
But the principle remains. Even thinking about this is useless until people use SPF or the equivalent.
If you want to know what method works, look at what Spammers are doing. Look at which systems (i.e. osirisoft, spamcop, spamhaus) the spammers are attacking. They are almost exclusively launching attacks at the relay blacklists. This is because this is the one method by which they are SHUT DOWN. Forget legislation. Forget all the other efforts. RBLs work. The next generation is to go from relay blacklisting, to relay-whitelisting.
After that, to block, tag, and/or delete the remaing spam would require a comprehensive, multifaceted approach such as the one I came up with.
I am 'eating my own dog food' and using my own software to filter out the junk sent to me at iamcf13@hotpop.com Recently, I got a reminder notice from a website I did business with quite a while back. I got the email because it contained no 'spammy' content. You see, spammers need 'spammy content' to hawk their wares--by filtering with that criteria in mind, it becomes (almost) impossible for spammers to communicate (and computer crackers to spread their malware). The ease of use and the connectivity of the internet via email is taken away from spammers. They can still spam but it will be effectively pointless as it is too inconvenient to 'decode' URLs and email addresses and type them into webbrowsers and email clients for further use--the ultimate aim of email spam laden with HTML, quoted printable content, %s, $s, numbers, URLs, and email addresses. As an added bonus, the computer crackers are silenced by filtering all malware out that come in the form of email attachments, or hostile HTML presented to HTML-aware email clients. By doing this, the spread of malware by email is minimized.
Since this post could be ultimately construed as spam, I offer these closing words:
Perhaps the greatest compliment paid to Admiral Rickover is the U. S. Navy submarine that bears his name
It's also to prevent them from impersonating well-known senders who might be whitelisted (e.g. Dave Farber's list, Declan McCullagh, Dogbert's New Ruling Class, other popular email newsletters), and to make it hard for phishers to send scam mail pretending to be your bank, etc. Whitelisting is a fairly necessary component of any spam filtering system, and if spammers can forge popularly whitelisted addresses, they'll get more mail through to potential suckers.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Somebody else pointed out that spammers are already buying lots of domain names - this just means that the services that are serving the domain herbalfakeviagra1324234.com need to add another couple of records to the DNS record, which is zero effort for the big spammers.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
What SPF does is let real people identify themselves in a way that makes it harder for the spammer to impersonate them. You can make sure that anybody who gets mail claiming to be from Otto@Ottosdomain.com can tell that it really came from you, not from some spammer impersonating you, which reduces the amount of complaints you'd get about the million-email spam run that went out with your name on it and reduces the number of people who received that message because you're in their whitelist.
If SPF or some Son-of-SPF becomes sufficiently widespread that lots of people start rejecting mail from non-SPF-advertising domains, then lots of spammers will start using it - but lots of spammers already get domain names, and just because mail appears to have legitimately originated from herbal-fake-viagra-21343214.biz doesn't make it any easier to track down, unless the spammer is stupider than usual.
The main way it makes it easier to track down spammers is that spammers who use free email services like yahoo and hotmail or cheap dial services like AOL will have to start using those services' mail-sending capabilities, which makes it easier for the services to throttle the amount of spam that goes out with their name on it, and easier to shut down abusers of free accounts quickly. But there are plenty of cheap email providers in China who aren't bothered if foreigners get annoyed as long as the spammers pay in advance, and lots of people with virus-infected PCs who could find the spam going out with _their_ names on it and their SPF verifying that it really came from their IP address.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
SPF itself was *NEVER* intended to stop spam.
SPF was intended to allow a mailserver to validate that the domain a mail was coming from was coming from a server under the control of, or authorized by the domain owner.
If a mail claims to be 'from' hotmail.com, *ISNT* coming from a server that hotmail.com says is legit for such mail to be coming from, you can safely reject it.
SPF's usefulness in combating spam comes from forcing spammers to use their own domains, and to make blocking a specific domain from sending you mail useful again.
Its not a magic bullet. Its just one tool. Yes, spammers can just register more domains. More that costs them money, which reduces the profitabilty of their spam, if only by a small amount.
If you have a pobox.com account, and want to send mail as username@pobox.com, you can connect to their SMTP server using SASL or other secure login mechanism, and it'll go out from there. I don't think they're currently using SPF to _prevent_ you from sending pobox.com mail from other IP addresses (or if they are, nobody's checking it, or nobody's sending me bouncegrams.) I have my current version of Eudora configured to be able to send mail out through pobox.com, but I also sometimes send it from my work email servers if I'm VPNed into work, or sometimes through another ISP I use for another email address.
It's possible to configure Eudora, and maybe other email clients, to use a different SMTP server based on which username you send mail from, so if I'm sending mail from joe.example@pobox.com, it'll use pobox's server, and if I'm sending mail from joe.example@my-dsl-provider.net , it'll send mail from my DSL provider's SMTP server (though I almost never use that email address except for mail to the DSL provider themselves, or for test messages.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
There is only one, and one only way to remove spam, and that is to make it illegal.
"There is only one, and one only way to remove drug abuse, and that is to make it illegal." Is the United States government winning the war on some drugs yet?
It can help a bit with the phishing case, because your bank can SPF-protect the domain example-bank.com and let you know that they'll always send email from that domain. That doesn't stop phishers from sending email from example-bank.biz or examp1e-bank.com (notice the number 1 in the name) unless Example Bank also bought that name, but it helps. And it doesn't stop them from sending mail from disposable-domain-1e3w243e2e.biz or BankFraudStoppers.com with a big GIF that points back to somewhere other than your real bank unless the recipient pays attention to the sender's domain name, but it helps. Digital signatures could also help a lot, if anybody used them.
It won't help much with viruses - if you get mail from your-coworker@your-company.com, SPF will show that it really came from them, even though they sent the REALLY COOL SCREENSAVER by clicking on the attachment rather than typing it in themselves. It may cut down a bit on mail pretending to be from Microsoft Security with an URGENT SECURITY UPDATE - CLICK HERE RIGHT NOW!!! but not so much.
SPF can prevent you from accepting mail from hijacked machines that fraudulently claims to be from an interesting domain, such as Example-Bank.com or Microsoft.com, or from a freemail system like Yahoo.com. It won't prevent you from accepting mail from hijacked machines that correctly claims to be from a non-interesting domain, like herbal-fake-viagra-2343243214.biz or M1cr0s0ft.com. It also won't prevent you from receiving mail that claims to be from the hijacked system's owner's domain, like spam from one of your coworkers or spam from "(Microsoft Security Update) port-132342134.cable-modem-company.net".
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
No kidding. Using the following 5 DNSBLs absolutely ELIMATES spam:
b s.net
sbl-xbl.spamhaus.org
bl.spamcop.net
dnsbl.sor
korea.blackholes.us
list.dsbl.org
I used to just use spamhaus and dsbl, but recently they started missing a few so I added korea and sorbs. I've had ONE SPAM get through after this, and after looking into it, it would have been caught by spamcop if I was using it. Without the DNSBLs I'd be getting hundreds of spams every day.
Combine the server-side DNSBLs with a server-side antivirus filter (ClamAV is excellent) and you can forget about needing a statistical filter on the client, because you will get ZERO spams, ZERO viruses. Freaking amazing... Makes me forget that we even have a spam problem until I see some poor sap with 500+ junk mails to sort through every day.
I can't believe that DNSBLs haven't gotten waaaay more attention. Seems like most of the focus is on bayesian and other statistical filters, which IMO is an ugly, error-prone waste of time.
Did I mention that there have been zero false positives with the DNSBLs? Granted, a few people who have been running insecure mail servers or who actually share an IP address with a spammer have been blocked, but as soon as they realize that it's *their* fault they're getting blocked, they're usually pretty quick to fix things on their end.
The biggest things I've seen that "somebody" needs to fix about SMTP and DNS are 8-bit cleanness, and unfortunately Verisigh's trying to add international domain names by radically breaking DNS for web-only use, and Unicode complicates the details of any character set support issues (not that that's a bad thing, it's just exposing the fact that the job is harder than it looks.)
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Now that spammers are publishing SPF, it is going to be so much easier to track them down. At the very least, we will be able to deny accepting their email from the start.
Now that more and more email is being authenticated, we can start to say, "Ah, this domain claims responsibility for this email." Now that we can attach a responsible party to each email, we can hold them accountable. At the very least, their reputation as a spammer will be well-known. At the very best, their illegal spams will be detected by law enforcement, and the owner of the domain name will be caught. Oh, they don't have accurate records? Well then the registrar is going to be held accountable. Oh, did they use a stolen credit card to buy the domain? Oh, they bought hundreds or even thousands of domains? When they get caught, which they will, they will never see the outside world again.
This article is pure FUD, and is all wrong. When spammers publish SPF, we have won.
The radical sect of Islam would either see you dead or "reverted" to Islam.
Because it can be automated. SPAM filtering software would work as such: If a sufficient amount of messages with valid SPF data from a given domain are marked as SPAM, block the domain from further sending.
True, this doesn't stop those inital messages, but it gets all the rest and cuts down on the number. One needs not eliminate SPAM enitrely, just reduce it to a level where it's unprofitable. If software becomes good to the point that only 1 in 100,000 SPAM messages reach a person, that'll severely cut profits, making it much less attractive.
Also if the spammers start breaking more laws like using stolen credit cards, it just increases their chances of getting busted. Every time you break the law, it's another chance you get caught. Do it all the time, it becomes almost a sure thing.
SPAM prosecution is still new and those responsible for prosecuting it still have problems understanding how to go about that really. Credit card fraud is old hat and they are pros. Plenty of people get put away for credit card fraud. Also, usually when you get nailed for something in relation to another crime, they stack everything they can on you.
It's not a panacea, but SPF sounds like another useful tool.
I mean lets say that the netadmins from major universities get together and decide enough is enough. Spammers are using SPF, and we just have to keep blocking domains. Ok, so we setup a database between all the I2 instutions that tracks SPAM, and distributes a RBL. Because we are research instutions, many public, we publish it too.
Well, now you SPAM any university using an address that has a valid SPF, your domain is gone isntantly from all the others, and anyone else that listens to us. That would be more like a domain every 30 seconds you'd need.
Dream on.
Verisign will sell a domain name to ANYONE. You can't get it yanked for anything connected to behaviour - unless it's selling the domain name to the trademark owner.
ISPs are the ones with antispam policies.
There are many people thinking how to block o avoid to receive spam ...
I'm using a antivirus/antispam solution in-a-box called Astaro Security Linux (ASL - www.astaro.com)
This solution has a good verification system that everyone should improve ...
When an email arrives to the ASL, it can make a lookup for the domain name ... is the domain name exists, it can ask to the domain for the mailbox existence ..
However, this technology needs the null-address capabilities turned on in the sender's domain ..
It's a good idea too ..
----
I think that SPF and SID are good technologies too ...
Another one solution could be the a small dialog between the sender and the destination email server ..
When an email arrives to the destination email server, it's send a confirmation message, so, the sender must confirm this message ...
The problem here, is the bandwith wasted and the increment of hardware resources uses ...
-----
See ya in the Cyberspace ...
Wrong. The only spam problem is Unsolicited Bulk Email.
There is no such thing as illegitimate email. Any such thing would at most be a syntax error.
Spam is about consent, not content.
I can throw myself at the ground, and miss.
I have a university e-mail address that ends with @msstate.edu. But I don't live on campus, I live in the surrounding town and so am not on the msstate.edu domain. My SMTP host is nctv.com.
Right now, you're allowed to use the @msstate.edu domain as a favor. The fact that you're able to use that address, sending from any IP on the net is a favor. If @msstate.edu gets tired of all of the craptastic bounce e-mails they get because spammers forge their domain onto e-mails, @msstate.edu may decide to force you to go through their official SMTP servers by publishing an SPF record.
*Entirely* up to the domain *owner*. If you're just a user of the domain, you need to address all complaints to the domain owner, or buy your own domain. The easiest solution for a domain admin is to setup secure SMTP on port 587 or something where the user has to authenticate using an encrypted session before being allowed to send mail.
SPF records are just a way to enforce the outbound mail rules that an admin chooses for their domain.
People have been trying very hard to get MS to understand the issues, but they doesn't seem to get it, and if they don't turn around soon, Sender ID can be buried.
Employee of Inrupt, Project Release Manager and Community Manager for Solid
Sure, if your spam scanner has a scoring system like Spamassassin, you could simply score "untrusted" domains a little higher- but tools like Spamassass already have an auto-whitelist that should take care of that automatically.
Features like "auto-whitelist" have only marginal value when anyone in the world can forge email from that domain. As you make forging harder, it makes the value of that feature go up.
Which is what SPF does. And I'd expect to see tools like Spamassassin shortly add in knowledge of that fact, and autowhitelist (or autoblacklist) more aggressively for domains with SPF turned on.
The bottom line is that a large amount of the time you can make decisions based on who is sending you email. SPF helps with any attempt to filter that, either positively or negatively. SPF also lets you trivially filter out a fraction of attempted forgeries. Both of these are good things.
Complete solution? No. Useful step? Yes.
Theres something wrong with all the replies to this /. article. Everyone seems to know exactly what SPF is and isn't. Has everyone suddenly started to RTFA? Is this the start of something? SlashDot: A New Hope!
Caesar si viveret, ad remum dareris.
What if you could collect $5.00 from your ISP for every message you flagged as SPAM because they billed the advertiser $10.00? "Honey, we got the check from AOL... they're only sending us $45.00 this month!"
On the other hand, if you really want to block email based on the SID then just flag all messages with valid SIDs as spam.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
Many of the virii look up smtp settings in the mail, when they look-up the addressbokk for possible friends to visit ;-)
So all we are going to see is the virii inheriting the user SPF record. All we are going to achieve is being able to bust ass of the lamers if we take legal recourse. Just imagining the cost and the uselessness is a nightmare.
followed through from someone's link to http://spf.pobox.com/objections.htm,p osals/IM2000/
I read about the IM2000 stuff @ http://homepages.tesco.net./~J.deBoynePollard/Pro
sounds tres sexy? I wonder if it would work?
somebody wanna rip it to shreds for our amusement (and further learning of course)...