Subject: [Asrg] rDNS revisited

From: "M Wild" <[email-masked]>
Date: Fri, 21 Mar 2003 11:02:33 -0500

Alrighty then...are there flaws with using rDNS?  Yes there are, many of
which various posters have covered.  I am not claiming that it is the end
all/be all solution it just worked on *MY* mail servers.  spam (note that
Spam is trademarked by Hormel...they request the email version be lowercase)
on my test account went from 180 messages per day to *TWO*  I don't think
anyone can argue that those numbers show that the test is effective.
Interestingly (and amusingly :) enough I also stopped receiving my M$
security bulletins and my ComputerWorld newsletter.  This was the pain I had
to put up with in order to reap the benefit.  Albeit this is my
experience...YMMV  What this test really cuts out is the ability for a
dynamic/pseudo-static client from masquerading as a "legitimate" mail
server.  Perhaps I haven't touched all the spam knobs on my MTA but when a
client says HELO 4.nnn.nnn.16 my mail server knows that this is patently
untrue however it is not instructed to check for that and just says 250 OK
(well it doesn't now :-/ )  This is ridiculous.  rDNS in this application
isn't meant to be an infallible identification of the sending server.  It is
meant to cull out the blatantly lying machines.  If you have to lie to me to
get me to take your mail I can assure you that I don't want it.

Regards
Mike

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: [email-masked]
Date: Fri, 21 Mar 2003 12:20:31 -0500

> security bulletins and my ComputerWorld newsletter.  This was the pain I had

So you miss the security bulletin, and as a result a user doesn't get
patched, and gets hit by some spam-injecting Trojan and now your rDNS
check doesn't stop the spam because your user has valid rDNS. ;)

*DAMN* those false positives can get expensive. ;)

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 23 Mar 2003 05:32:30 -0500

"M Wild" <[email-masked]> wrote:
> all/be all solution it just worked on *MY* mail servers.  spam ...

  ... for *you*.  It's anecodotal, and may not apply for others.

  This is one of the problems I have with many of the solutions.  The
proponents have tried their proposals, and seen a benefit.  It then
takes great effort to convince them that everyone else may NOT see a
benefit.

  I don't mean to shoot down any proposals, or to deny your
experience, but please understand that it may not be other peoples
experience.  We will need research, statistics, and analysis to
determine which solutions work, and what part of the problem space
they cover.

  Alan DeKok.