Subject: [Asrg] Amend the RFC to require reverse DNS

From: "M Wild" <[email-masked]>
Date: Tue, 18 Mar 2003 14:04:23 -0500

Greetings - One of the most effective anti-spam measures I have taken on my
mail servers is to require the sending mail server's IP address to reverse
resolve to the name it uses in its HELO command.  While this is a violation
of the RFC it eliminates lying machines and forces accountability on the
sending server.  Yes, I know it can be forged or spoofed however it still
significantly raises the level of effort required on the part of the
spammer.  I've had to turn this check off due to customer complaints however
I am reconsidering this decision.  Amending the RFC to *REQUIRE* correct and
complete DNS setup for a SMTP client would go a long way towards reducing my
undesired traffic.  It would also address the customer (and clueless
administrator) complaints with a simple "I am following the rules"  How can
you argue with that?

Regards
Mike

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Tue, 18 Mar 2003 15:05:32 -0500

> administrator) complaints with a simple "I am following the rules"  How can

1) Some 30% of IPs don't have proper PTR entries, according to a result posted
by Christian Huitema to the IETF list a while ago.

2) RFC1918 mandates that you don't leak 1918 addresses to the public net,
but some 30% of all queries that reach the *ROOT* nameservers have 1918
source addresses, indicating massive failures to deploy proper ingres/egress
filtering at border routers.

3) Wander over to the NANOG list and see what pain people are going through
because of old outdated bogon filters that include 69/8.

Remember why you had to turn it off - mandating it in an RFC means you'd
go back to that situation again for quite some time....
-- 
				Valdis Kletnieks
				Computer Systems Senior Engineer
				Virginia Tech

---

From: "Ronald F. Guilmette" <[email-masked]>
Date: Tue, 18 Mar 2003 13:27:28 -0800

In message <[email-masked]>, 

>by Christian Huitema to the IETF list a while ago.

Actually, I would say that something more like 98% of all IPv4 address
space has no reverse DNS.

That's the bad news.

The good news is that the vast majority of THAT un-rDNS'd space contains
-ZERO- well maintained mail servers that I personally feel any compelling
need to accept mail from, by default.

Of course, when/if the owners or users of those machines find that they
are blocked while trying to send mail to any address in the monkeys.com
domain, they are cordially invited to use the contact form on my web
site and request special whitelisting for their specific IP address(es)...
which I gladly provide to any non-spammer that requests it.

Regards,
rfg

P.S.  Recently, a couple of major ISP... specifically AT&T and RoadRunner...
tried, and failed, in implement filtering of IP addresses that have no
reverse DNS.  The problem in both cases was that this change created far
too many complaints, once it was first switched on, from the respective
customer bases.

The problem is that both companies began the implementation of this in
a rather dumb way.  They just stopped accepting mail from hosts with no
reverse DNS, period.  As far as I have been able to determine, they
FAILED collect their own mail servers logs for a few months prior to
the change-over, and they FAILED to whitelist all of the IPs that may
not have had proper reverse DNS, ever, but that nontheless had no black-
marks against them (i.e. not listed in the SBL, not listed in ORDB, not
listed in the UPL) _and_ that had already been sending mail... perhaps
lots of it... to these respective ISPs, and their respective customer
bases already, and in some cases for a long long LONG time.

As a friend of mine put it recently ``Would you switch your personal
mailbox to a pure whitelist-based systems and NOT at the same time
pre-initialize you personal whitelist with the entier current contents
of your own address book?''  No!  Of course not!  Pretty much the same
logic applies to switching a mail server over to rejecting mail from
no-rDNS hosts.  If you a sizable ISP, and if you do it without making
special exceptions for all of the servers that had previously been
sending you legit mail, then that is, in a word, dumb.

QUESTION: What generates most complaints (and the most heated complaints)
for those ISPs that attempt to do _anything_ in the way of spam filtering?
ANSWER:  When some given used has been on an existing mailing list already
FOR MONTHS and then, suddenly, it just stops arriving one day.

Moral of the Story:  It's ``ok'' to stop accepting incoming e-mail from
hosts that have no reverse DNS... even if you are a major ISP... as
long as you do it in an intelligent way that doesn't instantly piss off
(at least) half of your customer base.

The problem is that an awful lot of people implement what are otherwise
good ideas, but they only think about the possible problems and/or ways
to address those as an afterthought... AFTER the customer complaints
start arriving by the truckload.  And by then it's too late.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Steven F Siirila <[email-masked]>
Date: Wed, 19 Mar 2003 11:12:24 -0600

> too many complaints, once it was first switched on, from the respective

At the University of Minnesota, we have been blocking email from an
ever-increasing number of sites which have no valid rDNS.  Our approach
was to do this selectively, based on IP networks, adding new ones over time.
Presently we require rDNS for 172 class A networks (granted, many of
these are reserved IP space) and countless class B and C networks.
Last week we blocked 6% of our incoming mail in this way with very few
complaints.  It probably helps that outside users have a means of
requesting block exceptions from our users (via URL), which they can
grant or deny.
-- 

Steven F. Siirila			Office: Lind Hall, Room 130B
Internet Services			E-mail: [email-masked]
Office of Information Technology	Voice: (612) 626-0244
University of Minnesota
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked] (Justin Mason)
Date: Wed, 19 Mar 2003 10:21:41 -0800

Blocking based on rDNS, IMO, is bad -- it punishes an ISP's *users* rather
than the ISP themselves.

For example, until last week, I was using an ISP that did not have rDNS
for their outgoing SMTP servers.  Now *I* know the importance of rDNS for
SMTP servers etc., but I was just a user.   My 3 support requests didn't
count for much, and as far as I know the servers still have no rDNS.

The stock response to this is "well, change ISP" -- but that's a naive
view of most of the world, where the choice is not available.  In my case
(in Ireland), accessing the net through this ISP was 2/3 the price of its
nearest competitor.

No way was I going to pay extra for the privilege of not getting the
occasional bounce from an over-aggressive mail filter.  I mean,
considering I'm adminning a couple of spamfilter discussion groups, I get
a bounce message (generally on the level of "your mail contained the word
'viagra'") every 3 minutes anyway ;)

Also, requiring rDNS is not even that effective a test; our rule for this
condition in SpamAssassin gets this rate:

	35.5901   3.0576    0.921   0.78    1.33  NO_DNS_FOR_FROM

in other words 35.59% of spam has no rDNS, but 3.05% of ALL nonspam mail
does too.  The latter is bad news, it's a *very* high false positive rate.

--j.

---

From: Steven F Siirila <[email-masked]>
Date: Wed, 19 Mar 2003 12:33:13 -0600

> does too.  The latter is bad news, it's a *very* high false positive rate.

I should note that our rDNS is based on the calling MTA, NOT the envelope
FROM domain.

Again, if you have a means for users to "poke a hole through the block" in
a fashion that requires no intervention on the part of the mail admin (which
is the case with us) it allows the site to be more aggressive with rules
such as this.

--

---

From: John Johnson <[email-masked]>
Date: Wed, 19 Mar 2003 12:43:30 -0600 (CST)

> count for much, and as far as I know the servers still have no rDNS.

  That is the purpose of a group such as this - to establish standards
  expected for effective inter-operation. If your ISP does not adhere
  to *current* established standards, why would any additional changes
  be any more effective.

> (in Ireland), accessing the net through this ISP was 2/3 the price of its

  Complaining is not working? Do they even answer your requests?
  I'm sure that you are aware that paying them rewards them for
  not following standard practices.

> does too.  The latter is bad news, it's a *very* high false positive rate.

  Spam outfits have a habit of targeting secondary mail servers
  (higher MX value). By just introducing rDNS checks on our
  secondary mail server, we cut down on a huge amount of wasted
  connections.

---
   John Johnson - System Administrator;  Sirius Systems Group
   [email-masked]    KJ5AA
   (580) 355-6436

---

From: [email-masked] (Justin Mason)
Date: Wed, 19 Mar 2003 13:01:03 -0800

>   not following standard practices.

True -- but see above.  When a much stronger impetus (much cheaper net
access) applies, the details of their SMTP infrastructure is not as
important.  (Cheap net access in Ireland, BTW, means "under $100 a
month", cf http://www.irelandoffline.org/ ;).

(BTW in terms of other systems issues (uptime, reliability etc.) they are
pretty excellent; it's just this one issue I've been able to pick them
up on.)

>   secondary mail server, we cut down on a huge amount of wasted

That's a good technique, actually.  I can see that working without FPs
(until your primary MX suffers an outage that is ;)

--j.