Internetworkers: http://www.ibiblio.org/internetworkers/

[Steven Champeon <schampeo AT hesketh.com>]

on Wed, Nov 19, 2003 at 01:31:46PM -0500, James Manning wrote:
> > I use RFC 2919/2368 headers on my list - no C/R system should /ever/
> > respond to a message with such headers; at best, it should build a
> > whitelist of known legit mailing lists and avoid them. As for whether
> > a spammer can get around it - all the message needs is a legit email
> > for the reply-to, and ten minutes with perl to work around C/R. Give
> > the spammers a few months, if they haven't already determined ways to
> > work around the more popular systems.
> 
> That's the main reason I like SPF records, it moves the problem-space
> over to DNS, which is still a viable attack vector, but raises the
> effort level to much higher values and should put it about the
> risk/reward threshold that keeps spam a viable economic activity.
>     
>     http://spf.pobox.com/
> 
> So, whatcha think about SPF records, Steve?

I'm intrigued, and think that something like it is probably the answer -
there are a bunch of competing proposals out there, like designated
sender, which calls for a new DNS type, and others like SPF that
overload TXT. I honestly don't know which will win, but John Levine's
objections to SPF on IP are worth reading, as are Meng's replies:

 
http://www.interesting-people.org/archives/interesting-people/200305/msg00216.html

(Sorry for the stupid, redundant, long URL)

That said, I haven't gotten around to implementing SPF on my own servers;
I'm waiting for it to settle down long enough that I'm not updating all
of my zones to keep up with the latest draft.

I've achieved pretty remarkable results just blocking mail from hosts
whose rDNS looks script-generated, and matches certain naming convention
patterns, like 

.*dial[0-9]+\..+\.client2\.attbi\.com
[0-9]+\-[0-9]+\-[0-9]+\-[0-9]+\-ip\.alianzaviva\.net

etc. 

Now if I could get a certain bunch of freemail and ISP servers to block
that !$@%! Nigerian 419 spam, I'd be more or less spam-free.

-- 
hesketh.com/inc. v: (919) 834-2552 f: (919) 834-2554 w: http://hesketh.com
Book publishing is second only to furniture delivery in slowness. -b. schneier