Text 623, 196 rader
Skriven 2004-09-17 09:43:14 av Rich (1:379/45)
Kommentar till text 619 av Geo. (1:379/45)
Ärende: Re: Spammers faster than the good guys....
==================================================
From: "Rich" <@>
This is a multi-part message in MIME format.
------=_NextPart_000_0155_01C49C9A.C18C23A0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
The reverse DNS check to which I referred is not that the domain of =
the sending machine matches the domain of the sender. That is known not = to
work and is why Sender-ID has a richer mechanism. What was described = to me
is that the forward and reverse of the MX record match and that = the match the
net block owner or at least I have had email bounce from = someone that claimed
these checks. Maybe it is someone that doesn't get = high volume.
Rich
"Geo." <georger@nls.net> wrote in message news:414ab6ef@w3.nls.net...
No they don't, at least most don't.
For example netlink does a MX check but not a PTR check because there =
are tons
of domains that send mail thru a shared server (any ISP who hosts =
multiple
domains) and that server has only a single PTR record. As such that =
PTR can
match the forward lookup for the server but it can't match every =
domain the
server handles. If you just check the PTR and then do a forward lookup =
to see
if it matches then you gain nothing since pretty much every =
compromised home
machine has matching DNS entries like that so it's worthless. As a =
result the
only thing we bother checking is that an MX exists in order to sort of =
validate
the FROM address domain isn't total bs.
Don't misunderstand, some people do check the FROM domain against the =
PTR, but
those servers don't handle any volumes or they would quickly be out of
business.
Geo.
"Rich" <@> wrote in message news:414a62ee$1@w3.nls.net...
And the folks that check MX also often perform reverse DNS on the =
sending IP
to make sure the domain matches.
Rich
"Geo." <georger@nls.net> wrote in message =
news:414a202f@w3.nls.net...
"Rich" <@> wrote in message news:4147b794$1@w3.nls.net...
>> First, I'm still looking for you to provide real world examples =
that
anyone does this along with a description of how it benefits them.<<
Nobody does it yet because SPF isn't making the spammers lives any =
tougher
yet.
As far as the technique, all you do is point the MX record for the =
domain you
are spamming from and that's the IP address the bounces are going to =
go to.
>> As for your claim of no MX or MX pointing to a non-existent IP, =
you
better
explain why that doesn't address the issue you claim that spammers =
have. I
thinnk you are off in never never land. No MX record should be =
faster than a
valid MX as the NDR is abandoned.<<
That may be true, but no MX record is also a good way to get your =
mail
rejected
since lots of servers verify the sending domain has an MX record as =
part of
their spam filtering.
Geo.
------=_NextPart_000_0155_01C49C9A.C18C23A0
Content-Type: text/html;
charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=3DContent-Type content=3D"text/html; =
charset=3Diso-8859-1">
<META content=3D"MSHTML 6.00.3790.186" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=3D#ffffff>
<DIV><FONT face=3DArial size=3D2> The reverse DNS check to =
which I=20
referred is not that the domain of the sending machine matches the = domain of
the=20
sender. That is known not to work and is why Sender-ID has a = richer=20
mechanism. What was described to me is that the forward and = reverse of
the=20
MX record match and that the match the net block owner or at least I = have
had=20
email bounce from someone that claimed these checks. Maybe it is =
someone=20
that doesn't get high volume.</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<DIV><FONT face=3DArial size=3D2>Rich</FONT></DIV>
<DIV><FONT face=3DArial size=3D2></FONT> </DIV>
<BLOCKQUOTE=20
style=3D"PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; =
BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV>"Geo." <<A =
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote=20
in message <A=20
=
href=3D"news:414ab6ef@w3.nls.net">news:414ab6ef@w3.nls.net</A>...</DIV>No=
they=20
don't, at least most don't.<BR><BR>For example netlink does a MX check =
but not=20
a PTR check because there are tons<BR>of domains that send mail thru a =
shared=20
server (any ISP who hosts multiple<BR>domains) and that server has =
only a=20
single PTR record. As such that PTR can<BR>match the forward lookup =
for the=20
server but it can't match every domain the<BR>server handles. If you =
just=20
check the PTR and then do a forward lookup to see<BR>if it matches =
then you=20
gain nothing since pretty much every compromised home<BR>machine has =
matching=20
DNS entries like that so it's worthless. As a result the<BR>only thing =
we=20
bother checking is that an MX exists in order to sort of =
validate<BR>the FROM=20
address domain isn't total bs.<BR><BR>Don't misunderstand, some people =
do=20
check the FROM domain against the PTR, but<BR>those servers don't =
handle any=20
volumes or they would quickly be out =
of<BR>business.<BR><BR>Geo.<BR><BR>"Rich"=20
<@> wrote in message <A=20
=
href=3D"news:414a62ee$1@w3.nls.net">news:414a62ee$1@w3.nls.net</A>...<BR>=
=20
And the folks that check MX also often perform reverse DNS on the =
sending=20
IP<BR>to make sure the domain matches.<BR><BR>Rich<BR><BR> =
"Geo." <<A=20
href=3D"mailto:georger@nls.net">georger@nls.net</A>> wrote in =
message <A=20
=
href=3D"news:414a202f@w3.nls.net">news:414a202f@w3.nls.net</A>...<BR>&nbs=
p;=20
"Rich" <@> wrote in message <A=20
=
href=3D"news:4147b794$1@w3.nls.net">news:4147b794$1@w3.nls.net</A>...<BR>=
=20
>> First, I'm still looking for you to provide real =
world=20
examples that<BR> anyone does this along with a description of =
how it=20
benefits them.<<<BR><BR> Nobody does it yet because SPF =
isn't=20
making the spammers lives any tougher<BR>yet.<BR> As far as the=20
technique, all you do is point the MX record for the domain =
you<BR> are=20
spamming from and that's the IP address the bounces are going to go=20
to.<BR><BR> >> As for your claim of no MX or =
MX=20
pointing to a non-existent IP, you<BR>better<BR> explain why =
that=20
doesn't address the issue you claim that spammers have. =
I<BR> =20
thinnk you are off in never never land. No MX record should be =
faster=20
than a<BR> valid MX as the NDR is =
abandoned.<<<BR><BR> That=20
may be true, but no MX record is also a good way to get your=20
mail<BR>rejected<BR> since lots of servers verify the sending =
domain has=20
an MX record as part of<BR> their spam filtering.<BR><BR> =20
Geo.<BR><BR><BR></BLOCKQUOTE></BODY></HTML>
------=_NextPart_000_0155_01C49C9A.C18C23A0--
--- BBBS/NT v4.01 Flag-5
* Origin: Barktopia BBS Site http://HarborWebs.com:8081 (1:379/45)
|