Subject: [ietf-dkim] open-source IP Address reputation-building engine?

From: Dave CROCKER <[email-masked]>
Date: Wed, 14 Jul 2010 10:34:21 -0700

Does anyone know of an open-source module that is used to develop a reputation 
table by watching traffic and correlating spamminess with the original IP Address?

d/

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net
_______________________________________________
NOTE WELL: This list operates according to 
http://mipassoc.org/dkim/ietf-list-rules.html

---

From: Douglas Otis <[email-masked]>
Date: Thu, 15 Jul 2010 10:49:25 -0700

> table by watching traffic and correlating spamminess with the original IP Address?
Dave,

The program rbldnsd is an open source program used to publish 
reputations.  Unfortunately, inputs used to establish reputation provide 
nonlinear relationships when used to grant "forgiveness".  Forgiveness 
has become increasing important when dealing with the many compromised 
accounts.  Some simply now use a strategy of white-listing larger 
providers, but if everyone took that approach, email would quickly 
become useless as a service.  What can be said is that reputation is 
slow and as a result fairly ineffective at dealing with bot-net activity 
being emitted from otherwise "respectable" sources.

-Doug

---

From: "J.D. Falk" <[email-masked]>
Date: Thu, 15 Jul 2010 15:53:20 -0700

> table by watching traffic and correlating spamminess with the original IP Address?

All of the reputation systems I'm aware of are custom.  The MAAWG paper on reputation gives a fairly good overview of what the parts are, though.

---

From: Ian Eiloart <[email-masked]>
Date: Fri, 16 Jul 2010 15:11:26 +0100

--On 15 July 2010 10:49:25 -0700 Douglas Otis <[email-masked]> wrote:

>> Does anyone know of an open-source module that is used to develop a
>> reputation table by watching traffic and correlating spamminess with the
>> original IP Address?
>>
>> d/
>>
> Dave,
>

Yes, but why ask on a DKIM mailing list? I speculate that Dave wants to 
modify it to build a reputation engine based on Author address, for DKIM 
signed messages. With that, you don't have to forgive bad apples just 
because they share an IP address with lots of good senders. Add in 
reputation for envelope sender addresses when SPF passes, and you have *per 
sender* reputation database for (for us) the majority of inbound mail 
(that's passed IP reputation tests).

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/

---

From: Douglas Otis <[email-masked]>
Date: Fri, 16 Jul 2010 08:40:55 -0700

On 7/16/10 7:11 AM, Ian Eiloart wrote:
> Yes, but why ask on a DKIM mailing list? I speculate that Dave wants 
> to modify it to build a reputation engine based on Author address, for 
> DKIM signed messages. With that, you don't have to forgive bad apples 
> just because they share an IP address with lots of good senders. Add 
> in reputation for envelope sender addresses when SPF passes, and you 
> have *per sender* reputation database for (for us) the majority of 
> inbound mail (that's passed IP reputation tests).
Clearly, your suggestion is not related to DKIM, which makes no identity 
claim beyond the signing domain.  In addition, the charter for this 
working group excludes consideration of reputation and individual 
identities, which appears justified.

If I had to guess, I suspect it was intended to solve ADSP's inability 
to fully constrain the use of a domain.  Even with a very rapid response 
from a sender specific reputation scheme, such as VBR, bot-nets can 
modulate source identities at a rate that tend to make reputation 
schemes futile.  A scheme that attempts to include individual users 
would be encumbered with an massive database, making the process slower 
and even more vulnerable. A well targeted phishing campaign making use 
of a sub-domain that permits the use of mailing-lists will not trigger 
any feedback, since the messages would appear to be compliant with ADSP.

-Doug

---

From: Ian Eiloart <[email-masked]>
Date: Fri, 16 Jul 2010 17:40:29 +0100

> claim beyond the signing domain.

But, if I get an email purporting to be from a gmail account, and it's 
signed by the gmail.com domain, I reckon I'm going to assume that its safe 
to apply a reputation score to the sender address.

My suggestion has nothing to do with ADSP, or unsigned messages, and 
everything to do with email that carries a good signature. About 80% of 
signatures that I inspect are good.