Re: SRS comments/questions

On Sat, 2005-07-16 at 10:39 +0200, Michel Bouissou wrote:
> You're not sure that you receive it from the same _host_. You receive it from 
> the same _IP_.
> 
> This IP can host a legit enterprise email server, and a whole LAN natted on 
> the same IP thru its gateway, with tons of zombie/virussed Windows machines 
> that send direct-to-MX crap.

This is true, although thankfully it'll sometimes be the case that there
will be a firewall preventing them from directly accessing the outside
world if they choose to do so instead of using their local mail server.

I should look into using the HELO greeting in addition to the name for
whitelisting. That should catch a reasonable proportion of such cases,
and also of cases where dynamic IP addresses are reassigned.

> So yes, you definitely gain in keeping greylisting this IP for mails that 
> would come from a different domain as the usual legitimate domain(s) that get 
> out of the legit server...

Potentially, yes. It depends how much you care about delaying genuine
mail.

You could also argue that you gain in keeping greylisting for _all_
mail, and never whitelisting at all. After all, that army of zombie
Windows machines of which you speak may be sending mail with the same
HELO and MAIL FROM as the enterprise email server does. So you could
benefit by delaying _every_ valid mail you ever receive.

The only _real_ solution in the situation you give (other than that they
stop exposing using Windows machines connected to the Internet) is to
use one of the crypto-based techniques such as BATV/SES/DKIM so that the
zombies _can't_ create their fakes.

As you rightly point out, the IP address alone isn't enough -- although
it's not _such_ a bad heuristic for greylisting purposes.

-- 
dwmw2