Subject: RE: [Asrg] Lets Fix Mailing Lists

From: "Hallam-Baker, Phillip" <[email-masked]>
Date: Sat, 8 Mar 2003 21:28:33 -0800

You can't whitelist on the sender address domain unless you have 
authentication.

If you can trust that everything claiming to come from cisco.com or 
microsoft.com really is from there you can whitelist the zone.

I could draw up a whitelist of 95% of the zones that legit mail is 
likely to be sent from.

But if the spam senders can forge headers then they are soon ganna
be worthless.

And yes over 50% of my spams (ones I have received that is) have 
forged headers.

	Phill

> -----Original Message-----
> From: Vernon Schryver [mailto:[email-masked]]
> Sent: Saturday, March 08, 2003 10:59 PM
> To: [email-masked]
> Subject: Re: [Asrg] Lets Fix Mailing Lists
> 
> 
> > From: "Chris Lewis" <[email-masked]>
> 
> > > If you believe as I do that the reason genuine mail 
> forgery (as opposed
> > > to using a legitimately owned Hotmail dropbox) fell off 
> dramatically
> > > a year or three ago is related to the laws criminalizing 
> header forger,
> > > then you don't need any crypto.
> >
> > We still get a heck of a lot of spam that claims to be from our own 
> > servers and/or users.  Thousands of spam blowback (spam 
> forged in our
> > domains bouncing back) too.
> 
> Again, for the umpteenth time, of course there is some header forgery,
> but is it as much as most people claime?  I don't think so.  My guess
> is that perhaps 10% of what most people claim is "forged" spam really
> is.  10% of all of the spam in the world implies a "heck of a lot of
> blowback and other noise.  Do you have any evidence that your heck of
> a lot of forged spam is the majority or even a large fraction of spam?
> 
> My jihad in this area is to get people to stop using "forged" to mean
> "sender domain differs from SMTP client reverse DNS".  That sloppy
> language thinking is like using "douple plus super duper opt-in" for
> "(confirmed) opt-in."  People use both sorts of language to mislead
> and to try to justify positions that have no honest justification.
> 
> 
> Vernon Schryver    [email-masked]
> _______________________________________________
> Asrg mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/asrg
> 
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Sun, 9 Mar 2003 01:03:48 -0700 (MST)

> From: "Hallam-Baker, Phillip" <[email-masked]>

> You can't whitelist on the sender address domain unless you have 

That is wrong in the real world, at least today.  For example, lot of
mail has been authenticated by simplistic whitelists like that in
http://www.dcc-servers.net/dcc/dcc-tree/homedir/whitecommon

For years that page has been the most commonly fetched of all of the
on-line DCC source.  I'm not sure why that is, but I am sure that no
significant spam has used it for header forgery.  I theorize that
is because of the header forgery laws.

The DCC depends on whitelists and outfits installing the DCC usually
start their whitelists with that whitelist.  Maybe the DCC is too
small so recall that the current anti-spam filters of the big mail
providers involve per-user and probably per-provider whitelists.

> I could draw up a whitelist of 95% of the zones that legit mail is 

For you, but not for me or the next person.  More than a few people
complain about spam from microsoft.com.

> But if the spam senders can forge headers then they are soon ganna

Again, except for whitelist entries for one's own address, that is
not the case in the real world.

> And yes over 50% of my spams (ones I have received that is) have 

What do you define as "forged headers," genuine forgery or the bogus
notion that is merely inconsistencies between header or envelope domain
names and the reverse DNS name of the IP address of the SMTP client?