RE: uncatchable spam

I disagree..  the majority of spammers have outdated, inaccurate and/or malformed SPF..  Having said that I will emphasize that SPF is not really an anti-spam tool at all, but rather an anti-phishing tool.

Most of the spam I see comes from distributed spam nets, compromised machines and spam bots..  those would all be next to impossible to cover in an SPF

The big house spam sources are in the RBL's

Neither greylisting nor SPF nor heuristic filters nor RBL's nor DUL's are in themselves an answer to spam.  The only way to be effective at all is to run a multi-level anti-spam defense.  

The advice I gave about using valid SPF to exempt greylisting was - as I said - for the instance of someone running an underpowered mail server that was having issues with the additional load from greylisting.  The SPF tests are less of a resource load than greylisting and doing that could allow a marginal mail server to run without the queue reaching critical mass.  

Some spam getting through is a lesser evil than the mail server giving itself a DoS.

Of course a better answer is to throw money at the problem and buy ten times more mail server than you need, but everyone doesn't have that budgetary freedom.

Exempting greylisting via SPF does not whitelist anything, it just passes the mail on to the next layer of filtering.  

If you are depending on any one strategy to prevent spam from reaching your enterprise that is exactly why you have so much.
 

> -----Original Message-----
> From: D'Arcy J.M. Cain [mailto:[email protected]]
> Sent: Tuesday, October 05, 2010 12:54 PM
> To: [email protected]
> Cc: Kevin Kargel
> Subject: Re: uncatchable spam
> 
> On Tue, 5 Oct 2010 12:40:35 -0500
> Kevin Kargel <kkargel-BvA0c2rBOuxWk0Htik3J/[email protected]> wrote:
> > If you see performance issues because of greylisting then you can
> >consider exempting servers with valid SPF from greylisting.
> 
> That's awful advice and exactly what the spammers want you to do.
> Spammers jumped on the SPF bandwagon almost from day 1.  Spam servers
> issue their own SPF record and owned servers will often have valid SPF
> records.  If you are going to use SPF you should only ever use it to
> block email, not to whitelist it.
> 
> --
> D'Arcy J.M. Cain
> System Administrator, Vex.Net
> http://www.Vex.Net/
-- 
Eat sushi frequently. - Avi
[email protected] is the human contact address.
[email protected] is the list posting address.
See below URL for subscribe/unsubscribe and list options:
http://inet-access.net/mailman/listinfo/list