Re: Harvest netblocks of good MTAs from SPF for whitelisting from greylisting

On Feb 12, 2013, at 7:19 PM, Constantine A. Murenin <[email protected]> wrote:
> On 12 February 2013 14:55, Stuart D Gathman <[email protected]> wrote:
>> On Feb 12, Constantine A. Murenin transmitted in part:
>> 
>> 
>>> I'd guesstimate that a setup with pf(4) whitelisting of common MTAs
>>> through the SPF harvesting approach described, together with
>>> greylisting at the firewall level, for my domains would be much more
>>> effective in combating spam than any kind of SPF or DKIM
>>> implementations at my MTA level, and without the false positives.
>> 
>> 
>> But you are doing the same thing as SPF - except guessing the valid MTAs
>> instead of using the official list conveniently provided in SPF records.
>> If you are worried about efficiency, SPF records that don't involve
>> localpart or PTR macros can be resolved to a set of IPs (more general
>> than a netblock) with a TTL, and cached.  I believe libspf2 has this
>> feature already.  Take the union of the IP sets of all your "good"
>> domains if you are going to treat them all the same.
> 
> No.  I cannot have my firewall do SPF evaluations, and I'm not
> attempting to do the same thing as SPF.  I am also not guessing valid
> MTAs, I'm getting their list deterministically based on static SPF
> information that is published by relevant entities whose mail I might
> care to never delay.


Constantine, I think your approach is novel and interesting.  I'd like to see what the actual results are, as nothing beats real life data.

FWIW, my understanding is that there is a gap between the stuff that is easy to determine as "legit" and the stuff that is easy to flag as "unwanted" (when one throws the kitchen sink of tools available to make such a determination).  The trouble lies in the gap -- for any single piece of email in "the gap", is this piece of email:

- legit but routed in a weird way?
- a handcrafted phish?
- spam/malware from a compromised (but otherwise trusted) source?

Given the above, I'm curious to know how much email "in the gap" would be pulled out if you generate a bunch of netblocks from "good" SPF records and use that to manage your grey-listing.  

I would guess that you'd only be reinforcing stuff that has no problem being passed through as "legit".  But if you have data that shows otherwise, that is definitely something fun to poke at.

$0.02,
-= Tim