Re: IPv6 mail, was Let's try to be productive...

On Thu, Jan 09, 2014 at 05:10:41PM -0500, Barry Shein wrote:
> 
> On January 9, 2014 at 21:44 [email protected] (Martijn Grooten) wrote:
>  > 
>  > Apart from being able to drop the connection slightly earlier during the SMTP transaction, does this give you a significant advantage over just blacklisting (or whitelisting) individual email addresses? Something which I would think doesn't really scale.
> 
> Dropping the SMTP transaction "slightly earlier" can be the Holy Grail
> of surviving these onslaughts.

Sure.

But Richard's post refered to using IP(v6) addresses to distinguish
individual users at large webmail providers. If such users can send so
much spam to an organisation that this "slightly earlier" makes a
noticeable difference, then I'd say the webmail provider has a very big
problem.

> You have to sit here on a bad day when we're getting hundreds or even
> thousands of spam attempts per second, all the mail servers pegged,
> little or no legitimate mail getting through, phones ringing off the
> hook from customers who noticed they're not getting email, etc.
> 
> Put an IP block at various levels -- depends on the details of the
> attack, but the earlier in the chain the better -- and watch
> everything come back to normal when you get it right.

Out of curiosity: are you using some kind of anti-spam solution? Even if
it's just a DNSBL to drop connections from "known spammers".

For over the years I have come to realise that thanks to spam filters
and various actions against spammers and their networks (port 25
blocking, botnet takedowns, legislation etc.) the spam problem has 
been mitigated rather well: the vast majority of spam is blocked. Most
legitimate email arrives. Networks rarely get clogged and we don't need
significantly bigger tubes to deal with all the spam.

I always assume that the lack of activity in groups like this one and
its predecessors is for a large part because of that: it isn't easy to
make any actual difference any more.

I might of course be wrong. I know the quantity and quality of spam
received by various organisations differs a whole lot. I know that for
some it can be a very hard to mitigate pain. But perhaps I am
underestimating the number of organisations having for whom this is the
case. And perpahs I am just wrong about the state of spam.

Martijn.

-
This is the asrg mailing list.  To change your subscription settings, see
http://lists.services.net/cgi-bin/mj_wwwusr/domain=lists.gurus.org