[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [testlist] Rules for Rejecting Mail (was Re: Undelivered Mail Returned to Sender)




On May 15, 2008, at 10:38 PM, Eric Rescorla wrote:

As I indicated in my exchange with James, there's nothing stopping
a spammer from (1) registering a valid name and advertising
it in his HELO (2) simply advertising a totally random name that
doesn't map to his IP  in his HELO. Both of these measures will
evade rule (A), and indeed (2) is RFC 2821 compliant. Moreover,
as Danny observes, address literals are also RFC 2821 compliant
and appear to pass the current configuration.

Accordingly, here we have a situation where we have a rule that
is:

(1) easy for any spammer to bypass
(2) can be shown to have blocked legitimate mail in at least two cases
    [Note, you say "defer", but since the issue here is hosts without
records, not DNS failures, defer is just a particularly inconvenient
    form of block.]

But it blocks the vast majority of spambot traffic without additional CPU loading. This rule combo blocks thousands of spams a day on my server; I'd guess it to be millions on the IETF boxes.

--
Dean