De-spamming Your Inbox The Hard Way

Another approach... by beh · 2004-12-09 07:36 · Score: 3, Informative

You might entertain another method - if you have an internet domain of your own. Make use of mail-subdomains that you cycle through regularly.
And only trusted friends give permanent (or ermanent sub-domain) email addresses.

And as for mailing lists, if you use procmail to filter inbound messages on mailing lists, scan for specific things in it, e.g. don't just scan for the recipient, but also for specific mailing list headers. Anything that falls through this sieve you throw away (or, at least, quarantine it in a separate location).

Re:Another approach... by admp · 2004-12-09 07:37 · Score: 3, Insightful

This is the same as not using email at all. Personally I find this technique useless. Don't you?
Re:Another approach... by Steepe · 2004-12-09 07:39 · Score: 3, Interesting

I personally use alternate email aliases on my mail server that forward to my real account. then, once every couple of months, I delete those aliases and create new ones to post to websites, or use when I sign up for something. Only close personal friends get my real address, and if spam ever does show up directly at that address, I attack the spammer in every way possible. (spamcop, the spam fcc email address, etc)

Seems to work fine for me, and I can keep my mail server up 24/7.

--
Just three more hours seapeople and you can finally take me away from this crappy God Damned planet full of hippies
Re:Another approach... by Xeo2 · 2004-12-09 07:44 · Score: 2, Insightful

I don't think you understand. Your way is hard. His is easy.

--
___ alwaysBETA.com - Hey, you've got nothing better to do.
Re:Another approach... by gcaseye6677 · 2004-12-09 07:49 · Score: 3, Interesting

Speaking of attacking in every way possible, I'm surprised some group of "white hat hackers" hasn't come up with a DDOS spammer attack bot, kind of like the Lycos screensaver. This is something that couldn't be done by a corporation for liability reasons, but I doubt the FBI or other law enforcement groups are going to care if people are DDOSing known spamming networks. Even better, the spammers can't sue anyone unless they want a class action countersuit on behalf of those spammed.
Re:Another approach... by ReverendLoki · 2004-12-09 08:08 · Score: 5, Funny

. And there's no such thing as a white hat cracker.
... at least not after Labor Day...

--
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Re:Another approach... by whoever57 · 2004-12-09 08:14 · Score: 4, Informative

Speaking of attacking in every way possible, I'm surprised some group of "white hat hackers" hasn't come up with a DDOS spammer attack bot, kind of like the Lycos screensaver.
You have not looked at artists against 419, have you? It's not a bot, just a few web pages that continuously reload images from spammers' sites, but it seems to be effective.

--
The real "Libtards" are the Libertarians!
Re:Another approach... by YoJaUta · 2004-12-09 08:23 · Score: 2, Funny

... no such thing as a white hat cracker

What are you talking about? They just prefer to be called "klansmen."
Re:Another approach... by m50d · 2004-12-09 08:26 · Score: 2, Interesting

Then use a better email service. Really. Just because you have to be invited or because it's google doesn't make it the best.

--
I am trolling
Re:Another approach... by Anonymous Coward · 2004-12-09 08:26 · Score: 5, Interesting

Actually if you own a domain. Simply use abuse@yourdomainhere.com as your e-mail address. You will never receive any spam. I know this is not practical for most people but it works flawlessly.
Re:Another approach... by Kethinov · 2004-12-09 09:01 · Score: 4, Insightful

I wonder if someone might write a program or plugins for existing mail programs to adapt on this approach? Every time you mark a mail as junk, it sends it back to your mail server to be treated as if it were bounced. This way anything you mark as junk gets bounced back to the spammer as if your mail server was down. Have the cake and eat it too?

--
You're right, I wouldn't steal a car. But if it were possible, I sure as hell would download one!
Re:Another approach... by Kick+the+Donkey · 2004-12-09 09:02 · Score: 3, Funny

Wouldn't that be white hood cracker?

--
/. is a bunch of nerds at a million typewriters. It's not a political conspiracy determined to undermine your beliefs.
Re:Another approach... by MalaclypseTheYounger · 2004-12-09 09:12 · Score: 2, Interesting

Spammers don't want to send their outgoing emails to 'abuse' @ anything.com. They should know that abuse@whatever would be monitored by an IT Admin of some sort, and would use their spam to block them.

Nice little trick, I like it.

--
Check out the best P2P sharing website: MEDIACHEST.COM
Re:Another approach... by muixA · 2004-12-09 09:30 · Score: 2, Interesting

Often times a bounced message is useuless in dealing with spam, since they often do not have valid return paths. Or worse, they return to sources not the orginator, but a hijacted address.

If you've ever gotten a virus warning for a message you didn't send, you'll know what I mean.

You need to stop them at the IP/SMTP level if you really want to make sure they get the point. It's also a lot more satisfiying to think of a poor spambot getting a reject code.
Re:Another approach... by Chris84000000 · 2004-12-09 10:06 · Score: 2, Insightful

My guess for the reason the spam goes down is because when the mail server is off, it is unreachable, so the spamming program must wait for TCP connection request packets to timeout. Simply bouncing gives an immediate response, and the spammer won't care. But if the spamming operation has to hold up for a few seconds trying to reach a down machine, that actually motivates the spammer to remove you.

Since a TCP session must be set up before the message is transmitted, you can't have your cake and eat it too. At least not as the parent suggests.

--
Please stop misusing Catch-22 to describe chicken-egg problems or other paradoxes that are not Catch-22.
Re:Another approach... by prell · 2004-12-09 10:13 · Score: 2, Interesting

Apple's Mail program has a "Bounce" feature which I have used, but I don't think it has ever worked to this effect. I think what supposedly worked in this case is that the spammers were not even able to connect to the mail server; being able to connect and receiving a bounce message doesn't seem to "cut the cord" as it were.
Re:Another approach... by Mavakoy · 2004-12-09 10:26 · Score: 2, Funny

Yay, now they've been /.'d - lets see if we can obiliterate their bandwidth as well as the spammers...
Re:Another approach... by arget · 2004-12-09 10:30 · Score: 2, Informative

This doesn't actually work. Much of the spam the mail server I maintain sees goes to the abuse@ address, because for about a two or three month period, that address was the only one "scrapable" from the website, on the privacy policy. As that was the only place the abuse address was published, and because the abuse address had been active forever, but only started seeing spam traffic after it was published in the policy page, I can assure you that spambots just don't care enough to filter out abuse@.
Re:Another approach... by eric76 · 2004-12-09 10:59 · Score: 2, Interesting

What I've thought about doing is selectively refusing to accept e-mails for those users who wish to particpate in an experiment.

The logic is that a if a spam zombie is the source, they would just react to a problem by going to the next victim. A legitimate server will store the e-mail and try again.

Very few ISPs are so clueless that they don't queue and retry when they get a 4xx response (indicating a tempory failure). There are a few, but not many.

So if you refused all incoming e-mails the first attempt (or the first two attempts) with a mailbox full type message and then accept the e-mail on the next retry. You'd also want some minimum retry period, say 30 minutes. That way a spammer couldn't just try the same address two or three times in a row and reach it.

I'd bet that you could cut the number of spams you receive and the bandwidth eaten by it by 90% or more.

Of course, if everyone did this, the spammers would adapt. But then they'd at least have to store all the information so they could retry.

My suggestion is to match on the ip address of the sending host, the host name in the helo/ehlo, the mail from e-mail address, and the rcpt to e-mail address. If the spam zombie tries again but with a different ehlo or a different mail from, it would count as a first attempt. And entries would need to be deleted when reaching some maximum age.

It could also be coupled with a white-list apprach. Keep a white-list of the various helo/ehlo, mail from, and rcpt to items to determine which e-mail the user has indicated to pass through without refusing the first time or two.

Even if you just randomly refused an e-mail with a temporary problem, you'd cut down on the problem some. For example, 2/3 of the time, you might refuse to accept an e-mail with a mailbox full message. That way, you wouldn't have to keep track of anything. But spammers would be able to get through by just trying several times in a row when they got a 4xx message.
Re:Another approach... by Carnildo · 2004-12-09 11:10 · Score: 2, Informative

A cracker/black hat hacker is someone who breaks into networks with a malevolent intent, or anyone accused of cyber crime.

Conversely, a white hat hacker is someone who breaks security for altruistic purposes.

I think DDOSing spammers is altruistic, but there's an argument for malevolent intent, so there needs to be a third category: Vigilante Crackers.

The term for this I've seen is "grey hat hacker".

--
"They redundantly repeated themselves over and over again incessantly without end ad infinitum" -- ibid.
Re:Another approach... by devilspgd · 2004-12-09 11:52 · Score: 3, Insightful

And when a spammer puts your URL in their spam, you'll just happily pay the bandwidth bill in the name of fighting spammers?

Repeat after me: Do not fight abuse with abuse.

--
Give a man a fish, he'll eat for a day, but teach a man to phish...
Re:Another approach... by Anonymous Coward · 2004-12-09 11:58 · Score: 2, Funny

Your post advocates a (X) technical ( ) legislative ( ) market-based ( ) vigilante approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.) ( ) Spammers can easily use it to harvest email addresses (X) Mailing lists and other legitimate email uses would be affected ( ) No one will be able to find the guy or collect the money (X) It is defenseless against brute force attacks (X) It will stop spam for two weeks and then we'll be stuck with it (X) Users of email will not put up with it ( ) Microsoft will not put up with it ( ) The police will not put up with it ( ) Requires too much cooperation from spammers ( ) Requires immediate total cooperation from everybody at once ( ) Many email users cannot afford to lose business or alienate potential employers ( ) Spammers don't care about invalid addresses in their lists ( ) Anyone could anonymously destroy anyone else's career or business Specifically, your plan fails to account for ( ) Laws expressly prohibiting it ( ) Lack of centrally controlling authority for email ( ) Open relays in foreign countries ( ) Ease of searching tiny alphanumeric address space of all email addresses ( ) Asshats ( ) Jurisdictional problems ( ) Unpopularity of weird new taxes ( ) Public reluctance to accept weird new forms of money ( ) Huge existing software investment in SMTP ( ) Susceptibility of protocols other than SMTP to attack ( ) Willingness of users to install OS patches received by email (X) Armies of worm riddled broadband-connected Windows boxes ( ) Eternal arms race involved in all filtering approaches (X) Extreme profitability of spam ( ) Joe jobs and/or identity theft ( ) Technically illiterate politicians ( ) Extreme stupidity on the part of people who do business with spammers ( ) Dishonesty on the part of spammers themselves ( ) Bandwidth costs that are unaffected by client filtering ( ) Outlook and the following philosophical objections may also apply: ( ) Ideas similar to yours are easy to come up with, yet none have ever been shown practical ( ) Any scheme based on opt-out is unacceptable ( ) SMTP headers should not be the subject of legislation ( ) Blacklists suck ( ) Whitelists suck ( ) We should be able to talk about Viagra without being censored ( ) Countermeasures should not involve wire fraud or credit card fraud (X) Countermeasures should not involve sabotage of public networks ( ) Countermeasures must work if phased in gradually ( ) Sending email should be free ( ) Why should we have to trust you and your servers? ( ) Incompatiblity with open source or open source licenses ( ) Feel-good measures do nothing to solve the problem ( ) Temporary/one-time email addresses are cumbersome ( ) I don't want the government reading my email ( ) Killing them that way is not slow and painful enough Furthermore, this is what I think about you: (X) Sorry dude, but I don't think it would work. ( ) This is a stupid idea, and you're a stupid person for suggesting it. ( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
Re:Another approach... by GimmeFuel · 2004-12-09 12:23 · Score: 2, Interesting

Now that Thunderbird 1.0 is out, who wants to volunteer to turn that functionality into a TB extension?

--
live(free) || die;
Re:Another approach... by Propaganda13 · 2004-12-09 12:27 · Score: 2, Funny

And there's no such thing as a white hat cracker.

The South will rise again, ya damn Yankee.
Re:Another approach... by jaseuk · 2004-12-09 12:50 · Score: 2, Interesting

Yeah its called greylisting and it works very well.

You store the connecting IP, sender and recipient address in a database and temporarily reject the first time you see that combination for a configurable time (1 second is currently good enough)

A good greylisting engine will strip the last byte of the subnet incase mail is retried from different hosts in a mail cluster, for this reason its not a good idea to use the HELO address.

Greylisting stops almost all SPAM and pretty much all virus traffic as viruses also have weak SMTP engines that can't deal with temporary failures. In practice the only viruses I've found that make it through greylisting either bounced messages or from some ISPs that transparent proxy outgoing e-mail.

The SPAM that remains is easily handled by blacklists or SPAM Assassin as these SPAMs are sent through properly configured mail servers, so they are likely to be in domain or IP blacklists.

Given that a good proportion of SPAM is sent through zombied windows machines even if a SPAM is re-sent 30 minutes later it'll take a lot more work for a spammer to ensure that the same message is sent out twice by the same zombie.

Its baffling me why greylisting isn't the first line of protection for alot more people, its simple to setup (use postgrey with postfix) and is less prone to error and unobtrusive and higher in performance than virtually any other SPAM detection technique. Setting up and accepting three lines of text and checking against a database is certainly alot less performance overhead than invoking a virus scanner and spam assassin.

Of course spammers will always evolve, repeatedly sending the message from the same host would be enough to get the message through and those not using greylisting would now get twice as much SPAM, but that also means that a spammers throughput has been halved.

If grey listing is combined with a few select blacklists (including the excellent rhs.mailpolice.com URL list), plus SPAM assassin your closer to 100% and there are a great deal less false positives.

Another interesting approach I've used is to use rhs.mailpolice.com on our web cache, so that any URLs requested are checked against the SPAM blocklist. This blocks any inline images which might either offend or used as a call back for address verification, it also means that even if a phishing SPAM makes it through by the time the user reads it they are unable to view the page as its in the blocklist.

Jason.

Sure, that's fine... by BaldGhoti · 2004-12-09 07:36 · Score: 3, Insightful

...if you don't mind missing potentially important emails. It's a bit overdrastic and if you're supporting multiple users, it's going to be a totally unacceptable solution.

--
[insert witty sig here]

Re:Sure, that's fine... by jxyama · 2004-12-09 07:40 · Score: 2, Interesting

>...if you don't mind missing potentially important emails.
exactly. if this method is an option for you and you don't want to get pissed off at spam, simply don't check your email for a few days... you'll forget all about spam after a while.
of course, when you check the email after a few days, you'll have greater number of spam to go through and get even more pissed.
i'd like to call it the "serenity now!" method. :P
Re:Sure, that's fine... by spuke4000 · 2004-12-09 07:43 · Score: 3, Interesting

How about modifying your mailserver, such that when an email message is marked as spam it sends a message to the sender saying it bounced. That way you don't drop any valid emails, and at best you get dropped from the spammer's list, at worst you make it so spammers have to keep long lists of invalid email addresses in case they are implementing this filter.
Just a thought.

--
This post cannot be rebroadcast without the express written constent of Major League Baseball.
Re:Sure, that's fine... by Mr.+Slippery · 2004-12-09 07:44 · Score: 2, Informative

What kind of important emails will you be getting from someone you haven't corresponded with in 30 days?

Most of my friends are not heavy e-mailers, and often more than a month goes by between e-mail messages from them.

--
Tom Swiss | the infamous tms | my blog
You cannot wash away blood with blood
Re:Sure, that's fine... by fafaforza · 2004-12-09 07:49 · Score: 5, Informative

Most spammers use joe-job attacks so you'll likely get a double bounce back on your server, or someone innocent will get your bounce.

There's a typo in the dept. line by Anonymous Coward · 2004-12-09 07:37 · Score: 3, Funny

They left out a t.

Re:There's a typo in the dept. line by Kaimelar · 2004-12-09 08:57 · Score: 3, Funny

Sir (or Madam), I salute you. I've been editing technical proposals all day, and when I took a break to check Slashdot I was still in grammar-Nazi mode. The blatent screwup on the department line made me want to kill someone -- until I read your comment. I'm sure my coworkers are wondering why they keep hearing supressed laughter from my office.

Thanks for lightening up my entire afternoon.
Re:There's a typo in the dept. line by pjt33 · 2004-12-09 11:28 · Score: 2, Funny

The blatent screwup on the department line made me want to kill someone -- until I read your comment. I'm sure my coworkers are wondering why they keep hearing supressed laughter from my office.
When will Slashdot get an Ironic mod option?

Shutdown by Anonymous Coward · 2004-12-09 07:38 · Score: 5, Funny

In my case, a two-day shutdown resulted in 97.5% decrease in spam traffic!

Rumour has it that shutting down your server permanently will result in a 100% reduction in spam traffic.

Re:Shutdown by bluelip · 2004-12-09 08:28 · Score: 3, Insightful

If it was going to take that long, I'd throw up another box, point an mx record to it and hold the email there.

Would look more professional that eveyone getting email around the lines of "Your email could not be sent for the past X hours......"

Sendmail will do this almost out of the box if MX records are correct.

--

Yep, I never spell check.
More incorrect spellings can be found he

That's not the hard way by Neil+Blender · 2004-12-09 07:38 · Score: 3, Funny

Manually deleting them one by one is the hard way.

That only works for smart spammers by fireboy1919 · 2004-12-09 07:38 · Score: 4, Informative

Don't be fooled: there are plenty of stupid ones.

I shut down my e-mail server for a year and a half when I was getting the strange Spanish spams.

When I brought it back online again, I started seeing them again.

--
Mod me down and I will become more powerful than you can possibly imagine!

Re:That only works for smart spammers by Throtex · 2004-12-09 08:56 · Score: 2, Informative

I had an e-mail address I used primarily for signing up to services that I needed to get an e-mail back from (with an autogenerated password). This was hosted on a domain that I took offline for nearly two years. When I brought it up again and created an account for the old e-mail address, lo and behold, spam kept coming.

There's little to no incentive in purging spam mail lists.
Re:That only works for smart spammers by soliptic · 2004-12-09 09:32 · Score: 2, Interesting

Too true. I had an initials.surname@uni.ac.uk email address when I was a student. It died when I graduated. Almost 18 months later I got a job at the same uni, my account was created with the same mailname, and voila - 2 or 3 spanish language spams every hour. (and as a student i dont remember getting very much spam at all!)
Re:That only works for smart spammers by Feanturi · 2004-12-09 11:13 · Score: 2, Interesting

That's a variation of the usual joke I hear when I tell of my plight, however, that's entirely not the case. Real geeks don't use the web for pr0n or warez anyhow. The spams aren't porn-related most of the time, just the usual fare, but not in english. I suspect it somehow has something to do with my username, which I have used consistantly through the years on the net, and have often been mistaken for someone else as a result. Feanturi, the way I came upon it, is an elvish word, meaning spirit masters, although I have since learned that it is also a common first name in Finland. So some people think I'm Finnish, but I'm not.

For the spanish connection, I don't know but something really really weird happened to me one day on ICQ years ago. I was using the same username, and somebody approached me in random chat, and asked me some question in spanish. I replied that I didn't speak spanish and so, didn't understand them. The person wrote back, something long, with lots of exclamation points in it. I continued to protest that I didn't understand. 'No habla espanol' is about all I know. They switched to a larger font, restated their little rant, I protested again, so they switched to using all caps, and a still-larger font. They seemed to be getting very angry, and once they ran out of font sizes (for this continued for several more lines) they finally broke off the chat. And I was like, WTF??? Maybe Feanturi in spanish means something like baby-raper or somesuch, I have no idea.

Sounds a lot like worm prevention! by Tezkah · 2004-12-09 07:38 · Score: 2, Funny

Just unplug your ethernet cable and your Windows box will be safe from worms!

Beware the airborne version.

Exchange spam filter by John+the+Kiwi · 2004-12-09 07:39 · Score: 2, Insightful

What are the odds the new mail server he is using put spam filters on there for him and he just didn't notice?

consequence: by Progman3K · 2004-12-09 07:39 · Score: 4, Insightful

A few hundred random people received "The message you sent X was undeliverable" spam instead. Nice.

--
I don't know the meaning of the word 'don't' - J

Re:consequence: by Mr.+Bad+Example · 2004-12-09 08:23 · Score: 4, Funny

> A few hundred random people received
> "The message you sent X was undeliverable"
> spam instead.

That's the worst haiku I've ever seen.

This simply doesn't work. by barcodez · 2004-12-09 07:41 · Score: 5, Informative

I've got domains that I have left inactive for year then re-added them to dns and set up mail accounts for them and the spam comes in immediately.

Spammers simply aren't diligent when it comes to maintaining their list, they don't remove bounced emails (as they have spoofed all the headers anyway so they don't receive the bounces) they don't remove the address from domains without MX records or no reponding hosts(as they send all the spam from botnets that don't report failures back anyway).

I don't know what this guy did but he is thoroughly mistaken.

--

----

Re:This simply doesn't work. by SoTuA · 2004-12-09 07:51 · Score: 4, Insightful

I don't know what this guy did but he is thoroughly mistaken.
I'd bet a beer that the new mail server installed at his institute includes some form of spam protection. My university's mail system has gone down for two days, and I still get one or two hundred spam mails a day. (of course, only one or two make it through the spam filters :)
Re:This simply doesn't work. by Mastoid · 2004-12-09 08:29 · Score: 2, Informative

Yeah, I call bullshit too. I mean, think about this. SMTP was designed to deal with unreachable hosts, which is why most relays will keep trying for five days unless they receive a permanent failure notice (such as a rejection) from further along the chain.

A two day outage might send users into a frenzy, but as far as SMTP is concerned, it's nothing. Spammers wouldn't even notice the server was offline. That's even assuming they're sending directly, not relaying through some schmuck who doesn't know how to secure his mail server.

Seriously, how did this story get approved? It shows a level of uninformed misunderstanding right up there with confusing the Web for the Internet.

--
I had an argument...with the person here at the university that teaches OS design. I wonder when I'll learn --Linus

you mean greylisting? by ntr0py · 2004-12-09 07:41 · Score: 2, Informative

That sounds to be like a really inefficient form of greylisting.

By the way, I started greylisting on my mail server a couple of days ago, and my spam has gone down to virtually zero.

Re:you mean greylisting? by kasperd · 2004-12-09 09:13 · Score: 2, Interesting

That sounds to be like a really inefficient form of greylisting.

It sure does. A greylistning is a better approach. And with greylistning you lose no legitimate emails (unless the sender use a seriously broken mail server). Before greylistning was introduced on our mail server approximately 90% of all incoming mail was removed by spamassassin. And that is even with a very high threshold, so a lot of spam still made it past the filter.

Once greylistning was introduced the amount of incoming mail dropped by a factor of about ten. And those are still filtered by spamassassin, though only 40% are filtered and 60% let through. In total that means 90% stopped by greylistning, 4% blocked by spamassassin, and 6% let through. And in my experience about half of those let through both filters are spam. I don't want to think about what my Inbox would look like without spam filtering.

--

Do you care about the security of your wireless mouse?

have you ever considered.... by takitus · 2004-12-09 07:41 · Score: 2, Insightful

the fact they might have installed some anti-spam filters when they were upgrading the mail server? duhhh

Sounds like fun by hobo2k · 2004-12-09 07:42 · Score: 5, Funny

Anybody want to help me shutdown hotmail for a couple days?

Other option.. by Coleco · 2004-12-09 07:42 · Score: 3, Interesting

..perhaps won't slow the flow of spam but will let you know who that bastards are that are selling your email in the first place. Buy a domain name then use a different email address of every site that asks for an email.. for example 'amazon_email@yourdomain.com' if you fill in a form at amazon.com.

You'd be suprised at the sites that promise to protect privacy and don't.

Maybe they added spam filtering? by sterno · 2004-12-09 07:42 · Score: 4, Insightful

The article says that the school upgraded to a new version of Exchange during that two day period. IS it possible that during the course of the upgrade they also added some anti-spam features that aren't visible to the end user?

I know that personally I've had my mail server go down for more than two days without a backup relay and had no notable drop in spam traffic.

--
This sig has been temporarily disconnected or is no longer in service

Re:Maybe they added spam filtering? by naelurec · 2004-12-09 07:59 · Score: 2, Insightful

My thoughts exactly. This is a non-article, its amazing that it was posted to this site. With DNSRBL lists, some reasonable SMTP level filtering and spamassassin, I have had similar success in reducing the amount of spam.

Re:KDEMail? by rf600r · 2004-12-09 07:43 · Score: 4, Insightful

Bounce != no SMTP session at all

Spammers care little if at all about bounces. Ponder, for a moment, how many bounce messages his server sent when it was off if this is still confusing you.

Greylisting? by Doomie · 2004-12-09 07:43 · Score: 5, Informative

Isn't this just a variant of greylisting? (the link is the first hit on google for 'greylisting')

In case of our university mailserver it worked like magic. I was getting 100 spams per day and now I get 4-5 and these are mostly from 'professional' "spamming houses" (the ones with proper mailing lists and proper mailservers, but which don't like poeople who try to unsubscribe).

--
Doomie

Unacceptable by DanteBlack · 2004-12-09 07:46 · Score: 4, Insightful

This is a totaly unacceptable solution in a real-world business environment. Two days worth of bounced emails and even a moderate size company could miss over a $100K worth of online orders. Worse yet they could lose a current customer or, almost certainly, a potential customer. Customers as a rule don't take kindly to bounced orders and then they go to a competitor.

There are drop in solutions out there. Use them if it's a real issue.

--
I am invisble, and you can't see me.

Re:KDEMail? by Erik+Hensema · 2004-12-09 07:47 · Score: 5, Insightful

No. Bounces never reach the spammer. Ever. Spammers always use fake sender addresses, so the bounces will go to an innocent bystander.

So, while totally ineffective, you also burden the innocent bystander with yet another bounce.

The only way to combat spam is to reject it on the SMTP level.

Note that the guy in the article was wrong. When a mailserver is offline for two days, no bounces are sent. Sending mailservers will usually retry for 5 days before bouncing the message.

However, spammers don't use mailservers to send their spam, they deliver the spam direcly to the receiving mailserver. They've got instant feedback on wether the spam is accepted by the mailserver or not.

When a mailserver is offline, spammers will know immediately. However I doubt they'd remove your name from the list because of this simple fact. Mailservers are regulary offline for multiple days.

In this case I rather think they installed a very good spamfilter on that brand new Exchange Server.

--

This is your sig. There are thousands more, but this one is yours.

Didn't work for me. Bots are stubborn. by jakedata · 2004-12-09 07:47 · Score: 2, Informative

I decomissioned a mail server recently. The IP address is empty. The MX record is flat out gone.

Despite this, my packet sniffer still sees ~20 connection attempts per hour to that old address, nearly three months later. They are all bot-infected PCs according to sbl-xbl.spamhaus.org

That address was being mercilessly spammed and under constant dictionary attack.

Ultimately, I was able to use my log files to reconstruct the dictionary they were hitting me with. I put the whole thing under blacklist_to and saw a big drop in junk getting past my filters.

-j

Odd girlfriend comment by Anonymous Coward · 2004-12-09 07:48 · Score: 2, Funny

6) T to Y: a) If you have a girlfriend, take a vacation with her.
b) If you dont have a girlfriend, check mails on the temporary alternative email ID.

This just in: Apparently airlines, the U.S. highway system, hotels, parks and other attractions have now opened their doors to people without girlfriends. Also, coffeeshops, bars, music venues, theaters, yoga studios and other local businesses are consdering joining this pilot program on a case by base basis.

Those without girlfriends, then, might be able to take a 48 hour break from the Internet as well.

Yes, like greylisting. (ie, Postgrey for Postfix) by kriegsman · 2004-12-09 07:49 · Score: 5, Interesting

Our Postfix mail server uses Postgrey (click link for graph showing effectiveness), and it's as close to 'magic' as I've seen yet in the antispam category.

-Mark

Greylisting by mpeppler · 2004-12-09 07:51 · Score: 2, Informative

I added greylisting to my mail server, and that cut down on both spam and virus messages by a tremendous amount. See http://greylisting.org/ for more info.

Re:Another [failed] approach... by rjamestaylor · 2004-12-09 07:51 · Score: 5, Funny

From: Sammy Spammy To: undisclosed-receipient Subject: Don't buy this: Get it free! For a limited time you can get the Wally Whizbanger FREE!!!! ...

--
-- @rjamestaylor on Ello

"Bounce"ing Mail by Salvo · 2004-12-09 07:52 · Score: 2, Interesting

Mac OSX Mail has a feature which lets you "Bounce" Mail, which essentially mimics the Server Response to an invalid Email Address.
I was recently shocked to find that neither Outlook Express or Outlook have this feature.

Very useful for Spammers and Annoying Ex-Girlfriends.

trusted friends by oliverthered · 2004-12-09 08:07 · Score: 2, Insightful

Use pgp and sign there email.

--
thank God the internet isn't a human right.

Re:Reinstall Windows for E-mail by friedmud · 2004-12-09 08:08 · Score: 2, Interesting

I would have to agree with the Gmail spam filter.... it really does kick some major ass.

I have had a couple of "personal spam" (messages that are from legitimate people - but are SPAM to me - on college campuses this happens all the time) get through - but after Reporting those as spam it hasn't messed up since. On average it has been eating about 30 spam emails a day.

I used Mozilla Mail's spam filter for the last year or so - and just completely switched to Gmail last week - and have found it to be superior in all regards (Filters and Labels are AWESOME!).

Ok - enough Gmail love...

Friedmud

Your post advocates a.... by Anonymous Coward · 2004-12-09 08:09 · Score: 3, Funny

Your post advocates a

(x) technical ( ) legislative ( ) market-based ( ) vigilante

approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which vary from state to state.)

( ) Spammers can easily use it to harvest email addresses
(x) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
( ) It will stop spam for two weeks and then we'll be stuck with it
(x) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
( ) Requires cooperation from too many of your friends and is counterintuitive
( ) Requires immediate total cooperation from everybody at once
(x) Many email users cannot afford to lose business or alienate potential employers
(x) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
( ) Ideas similar to yours are easy to come up with, yet none have ever worked
( ) Other:

Specifically, your plan fails to account for

( ) Laws expressly prohibiting it
( ) Lack of centrally controlling authority for email
( ) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
( ) Asshats
( ) Jurisdictional problems
( ) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
( ) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
( ) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
(x) Extreme profitability of spam
( ) Joe jobs and/or identity theft
( ) Technically illiterate politicians
(x) Extreme stupidity on the part of people who do business with spammers
( ) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
( ) Other:

and the following philosophical objections may also apply:

( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
( ) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures cannot involve wire fraud or credit card fraud
( ) Countermeasures cannot involve sabotage of public networks
( ) Sending email should be free
( ) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
( ) Feel-good measures do nothing to solve the problem
(x) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
( ) Other:

Furthermore, this is what I think about you:

(x) Nice try, dude, but I don't think it will work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!

Logically shut it down! by telemonster · 2004-12-09 08:09 · Score: 2, Interesting

Come up with a white list of good addresses, and then reject all others. This way you loose a good amount of mail for the 2 days your shut down, but some important stuff would still get thru. Allow whitelist on border router or host firewall, deny everyone else.

--
Southeastern Virginia REPRESENT!

Re:Logically shut it down! by bwindle2 · 2004-12-09 08:43 · Score: 2, Insightful

And how is your border router (layer 3) going to see the RCPT TO address (layer 7)? Routers just pass packets, they don't examine packets for certain data. I've never seen a firewall that will examine TCP/25 packets for a RCPT TO address, either.

NO, don't bounce, reject at MTA level ONLY by gnuman99 · 2004-12-09 08:12 · Score: 5, Informative

I just did a quick test on my mail server (~2500 users) to bounce only the spam that our filtering system identifies as 90% probability or higher. That's about 45-50% of the spam we get. Here are the results

No no no. DO NOT bounce mail that doesn't pass though spam filter after you accepted it for delivery. You are only spamming someone else.

What you need to do is to reject the email BEFORE you accept it in the queue. That is, after DATA is complete, scan the email and if it fails the test, then reject it at the MTA level. If you accept the email in MTA (ie. after DATA is complete), then DO NOT bounce it because the headers do not have the real FROM: anyway (in case of spam)

Also, if you are bouncing mail after DATA, then your servers will try connecting to some other MTA raising your load. Bad idea.

Re:NO, don't bounce, reject at MTA level ONLY by Tripster · 2004-12-09 08:25 · Score: 4, Informative

This works great actually. There are a couple of methods to do it. I do it with SimScan (www.inter7.com) with my ISPs incoming MTA system. It checks incoming SMTP bodies with ClamAV and SpamAssassin and drops the viruses at the gate and if the message scores 10+ in SA it drops those at SMTP with a 5xx error.

Our previous method was with qmail-scanner which would then quarantine viruses and mark spam and pass it on to the end-user MTA. That method caused many pages due to high CPU usage when spammers hit hard.

The new SimScan system is C based so it is a tad easier on load, hardly see any red events anymore.

An alternative is available with Exim's exiscan patches for those using Exim.

After applying this system at my ISP the incoming spam levels have been reduced dramatically, we can still pass thru to those not wanting the filtering but for the rest of the customers they are very happy to not have nearly as much junk in the inbox.

Some have actually called wondering why they are only really getting their legitimate email now :)
Re:NO, don't bounce, reject at MTA level ONLY by MagicMike · 2004-12-09 09:27 · Score: 3, Informative

I recognize you were talking postfix, but sendmail has a plugin interface for this, where the modules are called "mail filters", or "milters" for short.

So you what you want then is spamass-milter and clamav-milter (both available from the dag RPM repository for modern redhat/fedore systems - so you can update them automatically for errata packages).

There must be something similar for postfix - its more advanced than sendmail, right? No sarcasm there either - I'm sure there's a way.

The only thing to watch out for is that both spamassassin and clamav will lock up sometimes while processing mail.

I finally took a second computer and scripted up a nagios filter check that sends mail to the mail server on a specific userid, then attempts to scp the mailbox over to make sure it got filtered. If the mail doesn't show up in 5 seconds, something is wrong, and it service stop/starts all the mail server components.

That sounds bad, but it really isn't. Happens about once a day, but no mail ever drops, the sending server just queues.

Finally, spammers and virus writers learn, so you're system needs to learn too, right? Set up "RulesDuJour" to update rules from the SpamAssassin Rules Emporium (SARE - http://www.rulesemporium.com/) so SA learns as the spammers learn, and be sure to update the ClamAV definitions regularly in an automated way, and you've got a robust system that updates itself and is monitored while being a good netizen by rejecting stuff at the MTA level.

The next thing you know, inboxes are squeeky clean, and the admin is relaxed.

Cheers.
Re:NO, don't bounce, reject at MTA level ONLY by Voivod · 2004-12-09 10:00 · Score: 2, Informative

No no no. DO NOT bounce mail that doesn't pass though spam filter after you accepted it for delivery. You are only spamming someone else.

Maybe I'm not following you, but even if you reject at the MTA level won't the exploited mail relay bounce the message to the forged originator anyway? The only difference is who is doing the bouncing. Either way, the rejected message is bounced, assuming that a 3rd party relay (and not custom spam software) is doing the sending.

I agree that rejecting at the MTA level is great, but I don't think the reason for this is that bounces will not result. The benefit is that your server is not having to do this wasteful work, and the exploited relay is, possibly leading it its eventual discovery. Either way the owner of the forged From address loses.
Re:NO, don't bounce, reject at MTA level ONLY by CritterNYC · 2004-12-09 10:09 · Score: 4, Informative

Maybe I'm not following you, but even if you reject at the MTA level won't the exploited mail relay bounce the message to the forged originator anyway? The only difference is who is doing the bouncing. Either way, the rejected message is bounced, assuming that a 3rd party relay (and not custom spam software) is doing the sending.

Most spam is coming from an exploited box directly. If it gets a 5xx Denied message, it just fails to send that message and generates no bounce. Legit mail from a real mail server will drop a bounce message in the sender's mailbox.

--
Portable versions of Firefox, GIMP, LibreOffice, etc
Re:NO, don't bounce, reject at MTA level ONLY by hyc · 2004-12-09 10:10 · Score: 2, Interesting

Yes. My badDNS milter for sendmail does exactly this. Handling the spam after your mail server has already accepted it is too late, my milter sends a reject code after receiving the envelope headers.

It also does a 20 second delay before sending the reject code, to slow down the spammer from moving on to their next target.

Read about it and download the source code on my web page.
http://highlandsun.com/hyc/

I've been using it for over a year and my spam-to-mail ratio dropped from 95% spam to 5% spam.

--
-- *My* journal is more interesting than *yours*...

mxlogic.com by dj42 · 2004-12-09 08:16 · Score: 2, Interesting

I use www.mxlogic.com to deny all medium-high risk spam completely. It intercepts it before it even hits my mail server. I like it.

--
We are one consciousness experiencing itself subjectively. Back to you with the weather, Bob!

Or delay delivery, and check again ... by theblackdeer · 2004-12-09 08:20 · Score: 5, Interesting

Our ISP has set up a slightly more elegant way to fliter out lots and lots of spam. They call it DoubleVerify.

From the FAQ (http://www.olympus.net/doubleVerifyNL):

DoubleVerify gets two chances to automatically identify mail. When mail arrives at our mail server the first time our server requests the sending mail server to send it a second time. Spammers rarely comply. Legitimate mail servers typically resend the mail about fifteen minutes later. Once OlympusNet receives mail the second time, it immediately delivers that mail and continues to immediately deliver mail from that sender. The DoubleVerify process works invisibly and is handled automatically by the mail servers.

You can whitelist entire domains (like your company, for example), too. It's worked pretty well for us.

Re:They're not going to be missed. by meme_police · 2004-12-09 08:21 · Score: 2, Insightful

"The servers trying to reach you will fail to connect, timeout, wait, try again. They don't try once and then give up."

Legitimate servers do that. Spammers and SMTP trojans on hijacked home computers don't usually try again.

--

The meme police, They live inside of my head

Here's MY answer and it works 100% by beacher · 2004-12-09 08:27 · Score: 2, Interesting

So far Ive had my setup email address (based on our account name) and I created one just for me. My email address is in the format blahblah_nospam@mindspring.com - Note: There actually is _nospam in my email address.

Account based email box ~ 25 spams/week over the past year.
My email account : 0!

Reasoning : spammers do s/nospam//ig; on their email addresses.

I really feel for that blahblah_@mindspring.com - They're getting my spam ;)

(For the pedantic yes I know mindspring whitelists - mindspring.com is used as an example)

-B

Patent Violate #4219589AS by Blitzenn · 2004-12-09 08:39 · Score: 2, Funny

I believe that you will find that turning off your email server to stop spam has been patented as the intellectual knowledge of Microsoft. You are in violation of that patent if you turn your server off for that reason. It is my understanding that they have hired RIAA to go after the low life criminals who are stealing this precious intellectual knowledge and prosecute them to the fullest extent of the law.

Re:Yes, like greylisting. (ie, Postgrey for Postfi by bwindle2 · 2004-12-09 08:39 · Score: 2, Insightful

How long until the spammers simply queue undeliverable email, and try again after a few minutes? I'm suprised they all haven't yet.

Those who don't understand technology are ... by Obfuscant · 2004-12-09 08:40 · Score: 5, Interesting

doomed to repeat it. From the article:

During that time, all the mails sent to my mail account were of course bouncing.

Of course they were NOT. During that time, emails sent to your account were being held at the sending server, or, in the case of spammers who aren't using open relays, there was a timeout during the connection to port 25 on your server. Neither results in a bounce. Most intelligent email systems are set up with a 5 day queue.

In other words, it will take 5 days for bounces to start being sent. That's for real email. For the spam, the bounces will be sent to fake addresses and the spammers will never see them.

I've had systems in place on many of my accounts for YEARS that bounce (reject with "unknown user" errors) spam and the same spammers keep sending the same shit over and over again. I've waatched the mail logs on my domain's servers where 99% of the incoming email is undeliverable spam (it ALL bounces) and the same spammers keep sending the same shit over and over again. Spammers simply either DO NOT CARE if they get a bounce, or do not see the bounces anyway.

There must be a different explanation for the reduction in spam. A new spam filter on the server, for example. Spammers seeing bounces and stopping is patently ridiculous.

Not a good idea by Q2Serpent · 2004-12-09 09:03 · Score: 4, Insightful

Many spam emails have forged 'from' addresses and/or envelope senders, so if you bounce the email, the bounce may end up at some unsuspecting person's email. This only adds to the problem.

Re:Not a good idea by paz5 · 2004-12-09 12:31 · Score: 3, Interesting

I have experianced first hand the repercussions of forged from fields. For a while (and probably still i was getting many message undeliverable emails and people asking to be taken off my list when a random user at my domain was being used as the from address in spam. The hundreds of emails i got a day forced me to turn off the catch all address, and recently i got notified of a complaint about my domain by my school. Has anyone else had this happen, and how can you deal with this?

Blocklists, Teergrubes, Bandwidth Suckers by billstewart · 2004-12-09 09:16 · Score: 4, Informative

Active cracker DDOSing is mean and nasty and you shouldn't do it. But there are better-behaved ways to use group efforts to stop spammers.

Blocklists are of course a critical tool - identify the spammers or the relays/proxies/zombies they exploit, publish their addresses so that people can reject mail from them.
Sugarplums and other spam poisoners generate web pages full of bogus trap addresses for spammer address harvesters, so that they can DDOS themselves. Infinite-loop web pages, bogus email addresses, email addresses of other spammers, email addresses of teergrubes, spambait addresses on your machines that tell you to block anything from that IP address. Imagine if everybody set your 404-not-found page to include a few bogus addresses for spammers to email to...
Teergruben are modified tarpit mail servers that answer SMTP v...errrrryyyyyyyy... sssssssllllloooooooowwwwwwwlllllllly, and can keep SMTP senders that talk to them tied up for minutes or hours. If you're running real SMTP on the same machine, you can configure the tarpit function to only happen for recognized spammer IP addresses, or else you can run a dedicated server (e.g. if you're not running your own SMTP on your DSL or cable modem.) One of these doesn't make much difference. Lots of teergrubes can tie up lots of spammers.
Bandwidth Suckers like Artists Against 419 repeatedly download images from spammer websites to tie up their bandwidth. Because many web sites and ISPs charge for bandwidth on a 95th percentile basis, two days of heavy downloads can totally jack their bandwidth bill for a month, and small sites (e.g. free web pages) that have quotas can be taken out for the month by aggressive downloads (1GB is about 6 hours at 384kbps, so you can blow out a small quota overnight.)

--

Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks

Re:Blocklists, Teergrubes, Bandwidth Suckers by jonastullus · 2004-12-09 11:36 · Score: 4, Insightful

- "blocklists" are also questionable because the maintainers of these lists gain a lot of power and often ask for huge amounts of money for address-ranges which were accidentally added to be removed again!

- "teergruben" are a nice idea, but they would have to rely on source address filtering or only kick in after a few hundred messages. and if the spammer simple multithreads his sending "server" he might not be THAT bothered with slower delivery, as he can have thousands of concurrent deliveries, totally bogging down the receiving server!
and also, if teergruben should just be the exception it is trivial to add a timeout to the delivery routine to abort after 1 minute or so of trying to deliver!

- "bandwidth suckers" - this is just the kind of anarchistic vigilante justice that SHOULD SIMPLY NOT occur! even if it were not for the "collateral damage" to the network infrastructure and "innocent" pages being accidently hit, this is no better than stoning criminal suspects to death without proper trial...

- "sugarplums" - this idea is actually pretty good but looking at the small return that spammers are getting at the moment this won't really slow them down much. even at 1% reached mail addresses the spammers still have virtually no cost in sending millions of mails out and thus will be hindered but far from stopped by injecting wrong mail addresses! also you have to generate those fake addresses without the spammers getting behind your mechanism of randomizing the addresses and you MUST also take care NEVER to inject a valid mail address by chance!

there has actually been quite a discussion how to make mailing more "reliable" on a grand scale and i still find the idea of forcing mail servers to solve some computationally expensive computation rather nice. although this will cost legitimate service providers a little in hardware this will hit the mass mailers by far worse because they simply rely on cheaply mailing millions of mailings in a short time frame...

well, so much for "innocent" protocols used in a hostile, mercantilistic, hard-to-trace and more-or-less-anonymous environment...

jethr0

Dumb article by fimbulvetr · 2004-12-09 09:21 · Score: 2, Interesting

This guy has no clue what's going on. His knee jerk reaction is that it must have been because they shut the system off.

Never, not once, did he consider the fact that his admins *upgraded* the exchange server. The probably went from 5.5/2000 to 2003.
By no means am I an M$ guru, but I know for a fact that 2003 comes with a large amount of internal things to help control and minimize spam.
In fact, anyone upgrading to 2003 sees drammatically better spam controls.

Someone revoke this guys geek license, as he just failed the critical thinking test.

for love of logic... by rich42 · 2004-12-09 09:35 · Score: 5, Funny

my car started running poorly a few months ago - so I took it into the shop. when I came back to get my car - they charged me $400. it runs great now. not driving my car for two days fixed it! now I'm going to try not driving it for 3 days to see if it fixes the rips in my upholstry. Also - did anyone else hear that you can reformat your 120GB drive to 260GB with no ill effects? I read that on slashdot a while ago!

This won't work - game theory by ari_j · 2004-12-09 09:43 · Score: 2, Insightful

The problem here is that spamming is easily modeled by game theory, and the spammers have a dominant strategy.

Your move: optimize how long you need to shut down your e-mail in order to minimize spam. Their move: check one day longer than your precaution allows for.

They can keep pushing it back until it is no longer useful for you to even have e-mail in the first place (i.e., you have more downtime than uptime), and either you end up not using e-mail at all or you end up receiving lots of spam.

Play the alias game... by whodkne · 2004-12-09 10:19 · Score: 2, Insightful

I just setup a catchall account on my domain and use whereIampostingmyemail@mydomain.com for every email address I give out. Not only does that identify WHO is sending me spam (shadyecomstore.com@mydomain.com) so I can track back and yell at them, but it allows me to create a rule to block addresses if they get to be too spammed over. This seems to work pretty well along with Baysean filtering and a few rules I have setup.

--
-Those who know do not say, Those who say do not know

I already know the answer by schickb · 2004-12-09 10:25 · Score: 2, Insightful

I think I'll model, simulate and then optimize the amount of shut-down time required for spam levels to drop to zero

No need for models and simulations... the answer is 'shut-down time' = Infinity

Don't use the FROM, just ban open relays by aws910 · 2004-12-09 11:22 · Score: 2, Interesting

The program should recognize which server it came from("received" in full headers), and blackhole that server because it's obviously an open relay, at the very least.

On a related note, I find it amazing that various antivirus/antispam vendors are still using the "From" line to report abuses. Do viruses or spam ever come from real email addresses? Not usually. I'm pretty much the victim of a "joe-job" on a regular basis because of this.

Re:KDEMail? by jonwil · 2004-12-09 11:25 · Score: 2, Insightful

Thats why we need to push for much greater adoption of Sender Permitted From (SPF).
That should prevent fake email addresses from being used.
Unfortunatly, large ISPs and email providers dont seem to want to implement SPF records for their mailservers.

Occum'on by PeterHammer · 2004-12-09 12:25 · Score: 2, Interesting

All technical considerations aside (3 day retry periods, no central spam DB etc.........) let's just read up on Exchange 2003 marketing literature (not that we should normally trust Microsoft marketing literature, but it suffices that they cannot outright lie about it). They claim to have all sort of *new* spam block features. Perhaps the author may have considered the hypothesis that his IT dept made the switch with these features in mind. At the very least it would be nice if he did a little due diligence (or if he did do some, that he would note that fact) to rule out simpler explanations? Why on earth would spammer's care about keeping lists clean anyway? It's not like they all of a sudden grew a conscience?

Didn't that Occum guy have something to say about crazy theories like this author's rant?

Bah by SCHecklerX · 2004-12-09 12:32 · Score: 3, Informative

What works well for me is mimedefang with spamassassin. My "It's Spam for sure" threshold is now about 3 points after a year or so of bayesian training. Most stuff I really want to look at comes in at -3 or less.

In mimedefang:

554 reject spamhaus sbl/xbl in filter_sender. This list is easy for people to get off of if they aren't spammers. Just tell them that is why they are rejected. Spammers, of course, won't even pay attention to the 554 and continue to hammer on your server *sigh*
have spamassassin continue to do the RBL checks anyway, as those other lists will add to the score (but we don't want to just reject on anything but spamhaus)
configure sendmail to use greet_pause (1000ms on my server)
reject helos that claim to be your own server in filter_sender
reject helos that are not a fqdn or ip address in filter_sender(just make sure that the helo has a dot in between something...spammers and zombies LOVE using single-word helos)
have mimedefang just discard anything that is above a certain spamassassin threshold in filter_end

You wouldn't believe how much stuff gets outright rejected just by checking the helo, greet_pause, and spamhaus. Spamassassin gets the rest.

I really don't know how I managed to run sendmail without mimedefang before.

Re:KDEMail? by ichimunki · 2004-12-09 12:40 · Score: 2, Informative

Believe me. The return address on penis enlargement stuff is fake (just like their product claims). The web links probably work, though. Anyone selling shady stuff via email is not going to put a real return address on it. They'll spend the whole day wading through angry messages from people fed up with spam, bounce messages, and hundreds of other non-revenue-generating emails. While not all spam headers are faked, the vast majority are.

--
I do not have a signature

Despamming The Easy Way by NuttyBee · 2004-12-09 14:50 · Score: 2, Informative

I have a personal domain that I give out to friends. Then I have a domain I use for e-mail for everyone other than friends and assign everyone a different e-mail address.

For example: microsoft@mydomainz.com for Microsoft. If Microsoft sends my info to a spammer, I can easily shut down the microsoft@mydomainz.com with a simple filter..

I noticed that a lot of spam came through from domain registration.. register1@mydomainz.com.. Now banned. register2.. Now banned. I think I'm on 3 right now.. Those spammers never learn.

The end result is my spam level, although not zero, is so dramatically reduced that its very manageable.. Most of it gets deleted as I see the headers, so it never actually gets read.

Re:Not a good idea ??? by MadAhab · 2004-12-09 15:36 · Score: 3, Interesting

You gotta be kidding. First of all, if it gets "bounced" back to some non-existent e-mail address, spammers don't get no word 'bout nothin'. Second even if it gets bounced back to spammers, they don't care. Many (most) of them are getting email lists from some spam-address distributor, so they don't see themselves as custodians of the list; they just blast away like drunks with diarrhea.

How do I know this? I've owned my domain since 1996, and I've been administrating the email since 1998. I get spam nearly every single day for beth@ahab.com (no point in cloaking it, really), and it has NEVER been a valid address. It often bounces back to the postmaster (me) after not bouncing back to their forged yahoo address and after NOT getting the word out to a single baby-eating spammer (you do know they eat babies, right?), and I see it when I bother scanning my postmaster folder for anything interesting.

Sure, it's worth my hassle if it bounces back to them, but it's probably not worth it to the poor sucker whose yahoo address they forged.

Get a clue: SPAMMERS DON'T CARE. You're kinda hoping that the guy who lets his dog shit on the sidewalk in front of your house is going to be annoyed by the smell.

--
Expanding a vast wasteland since 1996.

Re:SPF Records by Progman3K · 2004-12-09 19:07 · Score: 2, Insightful

I believe it IS good to have as much authentication as possible, but not to the point where it would make the system brittle. It just seems that the more security layers you have to go through, the more chance you have of something failing. What if you wanted to communicate with a non-compliant e-mail recipient? Obviously, if SPF becomes the law of the land, and EVERYONE starts using it, the problem of spam would go away, at least for a while ;-) But it's the same phenomena slowing IPv6 adoption, things work (albeit with certain problems) now.

--
I don't know the meaning of the word 'don't' - J

no, no, no by bogomipe · 2004-12-09 19:43 · Score: 2, Informative

This idea is as stupid as they get, the logic is flawed and experience has shown us otherwise. The most spam we get at our company is for accounts that have been bouncing for several years.

Surely no-one will act blindly on this poor fool's ramblings and kill their mail systems?

If you can't figure out what's wrong with it, don't try it.

--
- mipe -

Slashdot Mirror

De-spamming Your Inbox The Hard Way

100 of 631 comments (clear)