Subject: RE: [Asrg] 2.a.1 Analysis of Actual Spam Data - Experimental Desi gn

From: "Sauer, Damon" <[email-masked]>
Date: Mon, 18 Aug 2003 16:31:14 -0500

>>  Just an FYI - My ENTIRE mail volume dropped from an average of 50M a 
>> month  to 20M a month, with the same percentage being blocked at the 
>> content  filters, after implementing address checking (550 given) at 
>> the connection.

>	Keep in mind that there are those of us who simply refuse to 
>communicate with anyone that uses a C-R type system.

 It is not C-R. You give me a RCPT TO: the RCPT TO: is checked against my
address database. If it is good I say OK. If it is bad I say 550 No such
user. If you don't want to communicate with be because of that... I am
sorry- I guess we will never get your mail.
 But I have NEVER had a single, not one solitary complaint in the entire
year we have been doing this.
I think that it is VERY interesting that 40% of my volume just up and left
me alone after I started doing it however.

>	So, what's your loss in legitimate volume?  Do you know how many 
>people might have had real e-mail to send you, but decided not to 
>bother?

  I think that you just misunderstood how I am doing verifications.
Hopefully I explained it better above. I apologize for the confusion.

Brad Knowles, <[email-masked]>

"They that can give up essential liberty to obtain a little temporary safety
deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++)
R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* 
tv+z(+++)

*****
"The information transmitted is intended only for the person or entity to
which it is addressed and may contain confidential, proprietary, and/or
privileged material.  Any review, retransmission, dissemination or other use
of, or taking of any action in reliance upon, this information by persons or
entities other than the intended recipient is prohibited.  If you received
this in error, please contact the sender and delete the material from all
computers."

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Brad Knowles <[email-masked]>
Date: Mon, 18 Aug 2003 23:51:24 +0200

At 4:31 PM -0500 2003/08/18, Sauer, Damon wrote:

>   It is not C-R.

	Sorry, my mistake.  I misunderstood.

>                  You give me a RCPT TO: the RCPT TO: is checked against my
>  user.

	Okay, now I'm really confused.  I thought that most mail systems 
did this -- if you try to send mail to an account that doesn't exist, 
they respond with an error and refuse to accept the message.  Thus, 
the mail volume goes down.

	Is there something additional that has been done here?

-- 

"They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety."
     -Benjamin Franklin, Historical Review of Pennsylvania.

GCS/IT d+(-) s:+(++)>: a C++(+++)$ UMBSHI++++$ P+>++ L+ !E-(---) W+++(--) N+
!w--- O- M++ V PS++(+++) PE- Y+(++) PGP>+++ t+(+++) 5++(+++) X++(+++) R+(+++)
tv+(+++) b+(++++) DI+(++++) D+(++) G+(++++) e++>++++ h--- r---(+++)* z(+++)

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 19 Aug 2003 14:15:35 +0100

> 	Is there something additional that has been done here?

Indeed, many systems do not. A customer on a network that I'm familiar with
called the operations team to ask them if they could fiddle with their
firewall (in fact that firewall is managed by someone else that they hired
- which I guess they'd forgotten) to block port 25 for a particular IP
range.
The demand of generating bounces to a spam run (to no doubt forged senders)
had crippled their (exchange) server. When asked why they weren't just
rejecting unknown recipients they said that Mgmt wanted to see
"wrong email addresses".  How we laughed.

And then of course there's Yahoo and many others.

--

---

From: Brad Knowles <[email-masked]>
Date: Tue, 19 Aug 2003 16:13:15 +0200

>  "wrong email addresses".  How we laughed.

	Hmm.  Well, issuing response codes like that immediately to mail 
messages could also be used as a method of determining what are valid 
e-mail accounts.

	Out of curiosity, have you tried the reverse?  Specifically, 
seeing if you get more or less spam sent directly to your valid 
accounts when you do not issue 55x responses to attempts to send 
e-mail to invalid accounts?

>  And then of course there's Yahoo and many others.

	Due to the way the AOL mail system was structured, we had this 
problem as well.  This was resolved once they went to the 
next-generation mail gateway servers that had direct access to the 
back-end system, and could write the message directly through without 
any queueing.

	Of course, then spammers just try to route their effluent through 
the backup MXes, in the hope that they don't check whether or not the 
recipient is valid.  ;(

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 20 Aug 2003 12:34:26 +0100

> messages could also be used as a method of determining what are valid 

Yes, this is a well-known issue. Equally, it's not beyond the wit of man
(or spammer) to reconcile DSNs with probe messages.
I think that "accept then DSN" is a variation of "security through
obscurity"

> e-mail to invalid accounts?

I believe that we're talking about a research initiative which may address
this issue. At the time when we made the change from "accept and DSN" to
"550", we didn't have the luxury of experimenting. Every spam run/probe
against our sytems resulted in a DoS. This was intolerable (for us - others
will have different priorities).

> the backup MXes, in the hope that they don't check whether or not the 

Many do, indeed. Not all in my experience.
Of course the solution to this is to figure out how to replicate your valid
user db to your backup MX.

--