Subject: Re: [Asrg] Slowing down spammers - thoughts?

From: Scott Nelson <[email-masked]>
Date: Fri, 11 Jul 2003 10:46:00 -0700

At 06:39 AM 7/11/03 -0400, C. Wegrzyn wrote:
>I've been giving more thought to how to slow down spamming. It seems we 
>should just follow 7.3 of RFC2821 - return either 250 or 252 to VRFY and 
>EXPN commands.  In this way the sender can't find out if someone is 
>really on a system.
>

First, the advice given in RFC 2821 section 7.3 isn't quite right.
If you don't support EXPN then it shouldn't be in the EHLO response, 
and the correct error code is "503 5.5.1 Invalid command".
252 would only be correct if you make the decision to allow EXPN 
on a case by case basis, after the EHLO - 
for example, if you allowed EXPN only after AUTH.
As far as I know, no one does that.

Second, most systems that check, check using RCPT TO instead of VRFY.
(And most incorrectly assume that anything other than 250 means
 non-existent, failing on "451 4.2.2 mailbox full", but that's
 another topic.)  With the exception of me testing the command,
I haven't seen a single VRFY command in my logs, ever.

Third, I have seen some pretty convincing evidence that if a spammer
/thinks/ an address is valid, they will hammer the mailbox forever.  
(Not all spammers of course, but some.) 
No amount of "550 5.1.1 No such user" will dissuade them.  
If spammers actually checked with VRFY, returning 252 to all
such queries would risk /increasing/ the amount of spam attempted.
But since no one uses VRFY anyway, that's moot.

Forth, Is there any evidence that hiding addresses works?
Perhaps the effectiveness of address hiding should be researched.

>Second I would kick back a 551 to every message being sent by a 
>domain/user I don't recognize or wanted to reject as SPAM. In the former 
>case I would send the email to the real recipient allowing them to 
>decide what to do with it. I the latter case I would just toss it or 
>fill in the subject with SPAM:.
>
>Thoughts?
>

Seems to me that you'd get a lot of false positives that way.

Scott Nelson <[email-masked]>

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "C. Wegrzyn" <[email-masked]>
Date: Fri, 11 Jul 2003 17:58:11 -0400

Scott, thanks for the analysis. All I know is what I have seen - when I 
have hidden an address (actually removing it) the spam to the account 
did drop but over a long time (6 months).

Chuck