Re: why our server got listed?

D-W-S wrote:
> Oleg Bulyzhin wrote on Thu, 4 May 2006 20:46:39 +0000 (UTC):
> 
> 
>>As i mentioned above i'm talking about DSNs (which i incorrectly named 
>>bounce). Supressing DSNs is standard violation. _There are_ situations 
>>when you should accept mail and deliver it later.
> 
> 
> Nobody wants you to suppress the DSN. What we (tinw) *do* want you to do 
> is rig your secondary MX such that the situation in which a DSN should 
> be sent no longer arises.
> 
> LDAP goes a long way towards solving your problems. By using LDAP, your 
> secondary MX can have access to the user list on the primary MX, and 
> therefore REJECT (rather than bounce) messages sent to non-existent 
> users. No more backscatter.
> 
> Admittedly, accounts over quota are another problem. However, I'm sure 
> that most of your problems are due to non-existent users.

A new worm seems to have surfaced this week and already it is causing 
significant backscatter from e-mail systems that send DSN for no such 
users and over quota users.

The last SOBER worm could cause a single mail domain sending DSNs for 
non-existent users to mailbomb an innocent victim at 40 messages per 
second for a period of 24 hours.  The only pauses that I saw was when 
the system sending the DNS messages was listed by spamcop.net for it's 
mailbombing.

The advent of these worms makes the idea of accept and bounce later 
obsolete.  The SMTP mail system can no longer handle that amount of 
backscatter when a worm breaks out.  The test.com domain a few years ago 
was a case where the backscatter was so high that it at least for a 
while knocked them off the internet.

A mail server accepting e-mail from the public internet now has to make 
the decision as to accept the e-mail or not during the SMTP session.

For a forwarding server, this means that it needs to know all the e-mail 
addresses that it is accepting e-mail for, and it needs to have a buffer 
for delivering to internal mail servers.

At the time that a message comes in, the gateway SMTP server can do a 
probe to see if the destination SMTP mail server is up, and if it is 
not, it can reject the message with a 4xx SMTP code.

If a mail server accepts a message for delivery and it can not be 
delivered, it should be directed to the human running the postmaster for 
manual disposition.  Until the human running the postmaster account has 
handled that message for that e-mail address and resolved the 
non-delivery problem, all future e-mail for that e-mail address should 
be rejected with a 4xx SMTP code.

This allows you to operate a forwarding mail server in compliance with 
the RFCs and with out generating backscatter.

Also note that I saw reports on news.admin.net-abuse.email about 
spamhaus.org listing mail servers for backscatter before spamcop.net 
changed their policy to do so.

-John
[email protected]
Personal Opinion Only