Subject: Re: [ietf-smtp] test for port 25 of sending MTA - for spam detection

From: Rich Kulawiec <[email-masked]>
Date: Sat, 14 Sep 2013 07:54:36 -0400

On Fri, Aug 23, 2013 at 03:27:47AM +0200, [email-masked] wrote:
> Just a thought I had for spam detection: what about testing if you could
> connect to port 25 on the sending MTA? 

First, initiating an outbound network connection in response to an
inbound connection of unknown and quite likely dubious provenance
is an intrinsically bad idea.  As we've seen, for example, with the
abusive/short-sighted/ineffective idea of "SMTP callbacks", which
have readily lent themselves to DDoS attacks against third parties.

Second, there are MANY hosts which emit legitimate SMTP traffic but
which do not answer on port 25.

Third, there are much better ways to deal with zombie-initiated spam.
Using "greetpause" and "greylisting", for example.  Refusing all mail
from anything without proper rDNS, proper matching rDNS/DNS, and proper
HELO.  Refusing all mail from anything with a generic hostname.  Refusing
all mail from dynamic IP space.  (See Steve Hesketh's excellent work
on this, for example.)  Combinations of these are quite effective,
they're simple, they're difficult to game, they're efficient, they're
reliable, they exhibit very low FP and FN rates, and they interoperate
beautifully with other measures.

---rsk

---

From: "Robert A. Rosenberg" <[email-masked]>
Date: Sun, 15 Sep 2013 22:26:54 -0400

At 07:54 -0400 on 09/14/2013, Rich Kulawiec wrote about Re: 
[ietf-smtp] test for port 25 of sending MTA - for spam :

>Refusing all mail from anything with a generic hostname.  Refusing
>on this, for example.)

These two make it impossible for a user's mail client to submit email 
to your MTA Server. Having the MTA require the mail client do a 
sign-on validates the mail client without needing to ban it's IP 
address or DSN name. If this discussion is about monitoring a MTA 
doing the forwarding to you, that is a separate issue.

---

From: "John Levine" <[email-masked]>
Date: 16 Sep 2013 04:04:13 -0000

>to your MTA Server.

Yes, we know.  Most people have separate submission and relay servers,
or if they don't, they configure the shared server to accept SMTP AUTH
from anyone, but un-authed mail only from addresses that aren't blacklisted.