Re: Are you seeing these mailer bounces?

Jem wrote:
> These are annoying me so much. The problem of "backscatter" as it's called 
> has been around for years, but it really seems to be picking up in volume. 
> One of the reasons is that there are 'holes' or vulnerabilities in major 
> mail servers, so they can be easily convinced to send such backscatter out.
>
>   
Yes, "Domain Spoofing" leading to 'bounced' email instead of 'rejected' 
email.

A SPF record will help a little. Many of the major players are onboard 
with SPF, but these same major players for the most part do not bounce 
spam.. AOL, Earthlink... and many many others. However, the more that 
add records, the more widespread the ability to block based on SPF will 
become. I for one expect that eventually someone like AOL will begin to 
require a SPF record just as they now require rev dns.. but that is 
still years away. I wish it were next month myself, as this would put an 
end to the use of zombie computers by spammers. Incidentally, a recent 
article by Yahoo stated that around 400,000 new zombie machines are 
added each day!!!! WOW!!!

Some blocklist consider backscatter to be the same as spam. SpamCop for 
one. So, if you have a system which is bouncing after receipt, you are 
subject to landing on this or other blocklists. Is this right or wrong? 
Technically it is wrong, but having had my own domain spoofed has a 
tendency to sway my opinion from that of 'technical' to that of SpamCop 
is right.

I do think more of this is happening due to various spam programs 
running deeper and deeper into the mail delivery system, all the way to 
the end user's PC, at which point bounce is the only option as reject 
has long since passed.

It is a conundrum, but basically in my opinion, spam should either be 
delivered or deleted... never bounced.. or rejected at the smtp process 
using something like SpamHaus. I also am running milter-ahead on our 
backup mailserver which looks forward to the server that should be 
receiving the email to check for a legit user or that in fact the server 
is up.. if not it rejects the email. This took care of any backscatter 
we were producing.

I do think the spammers are actually looking for poorly configured 
scripts/mailsystems to use to bounce their spam to their intended 
recipient. As a sysadmin I really can't block or classify as spam 
bounced mail, as this is indicative of problems so many times, but it 
sure is irritating when it is just backscatter.

And yes, sorry as this is a bit off topic from SpamProbe.. but is why we 
should consider what we are actually doing before bouncing any email.

Best,
John Hinton


-------------------------------------------------------------------------
Take Surveys. Earn Cash. Influence the Future of IT
Join SourceForge.net's Techsay panel and you'll get the chance to share your
opinions on IT & business topics through brief surveys - and earn cash
http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV