RE: ISP outbound SMTP filtering

Specifically regarding SMTP we have chosen to filter outgoing SMTP from
our dynamic PI blocks.  We allow outgoing SMTP from our static blocks.
The reasons for this policy are varied.

The prime mover, of course, is to damp the botnet activity.  It also
tends to limit activity from spammous customers, as we also limit
envelope recipients on traffic relayed through our mail server.  This
has made a tremendous difference and I would consider it a necessity for
an ISP.  

Being a medium sized ISP we do not filter outgoing SMTP for the static
IP blocks because those are much more easily auditable, and when
problems do arise we can take the time to deal directly with the
offending customer.  

It is somewhat of a tough call, because as an ISP our responsibilities
and loyalties must be to our customers.  We have an obligation to
provide them with as much freedom as possible.  The threshold occurs
when that freedom endangers the network, and hence our other customers.


We also filter email at our mail servers to only allow email From:
domains that are either hosted on the mail server or made known to the
admin staff.  Damping return address forgery has proven functional. 

Kevin

:$s/worry/happy/g 

 

> -----Original Message-----
> From: [email protected] 
> [mailto:[email protected]] On Behalf Of Brian Johnson
> Sent: Wednesday, May 30, 2007 11:12 AM
> To: [email protected]
> Subject: ISP outbound SMTP filtering
> 
> 
> I have been contemplating our outbound filtering policy and 
> am wondering what kind of outbound filters other 
> regional/local ISPs are using.
> Currently
> we are looking at blocking outbound SMTP to curb botnet 
> spamming systems, but would be interested in any "standard" 
> filters that you are applying to prevent "bad traffic" from users.
> 
> For those of you who have done this, does it work? What 
> issues have you had?
> General comments.
> 
> For those who don't do this, why? What reasons do you have 
> for not doing this? General comments.
> 
> TIA.
> 
> - Brian
> _______________________________________________
> "Eat sushi frequently". - Avi
> [email protected] is the human contact address.
> [email protected] is the list posting address.
> See below URL for subscribe/unsubscribe and list options:
> http://inet-access.net/mailman/listinfo/list
> 
_______________________________________________
"Eat sushi frequently". - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list