Subject: [Asrg] Re: A plea for more hierarchy in DNS

From: "Douglas Campbell" <[email-masked]>
Date: Mon, 1 Nov 2004 07:31:09 -0800 (PST)

On 30 OCT 2004, Peter J. Holzer said:

> Last time I looked, MTAmark needed only a couple of TXT records. No
> change of DNS or BIND necessary.
>

Ah, thank you Peter.  The light comes on.

>> To be really honest, I'm small fry.  I don't do my own DNS -- I let my
>> registrar do it.  And the interface they have doesn't seem to allow for
>> TXT records.
>
> You aren't the only one. My ISP doesn't delegate reverse DNS for /29
> networks, so I couldn't implement MTAmark for my home network myself but
> need my ISP to do that. (OTOH, maybe that isn't that bad - let ISPs
> publish MTA=no indications for their whole range and customers who want
> to run their own MTA have to explicitely tell their ISP).

This is why the light took so long.  I read the spec but didn't get the
part about the TXT records for reverse lookups being the only valid ones. 
That means I can't set them myself, but must rely on the controller of my
address range to do it (which might NOT be my ISP).  This does not seem
onerous; I'd expect them to be eager to cut the spam transiting their
network.  I would certainly be willing to pay a fee to allow my mailserver
access to the network.  Some of the ISP's (particularly those in Asia and
Latin America) just don't seem to care what their network emits -- they
take the money and turn a blind eye.  I have whole countries on my
blacklists now.  What a pain.

The problem is that SPAM is business -- the big spammers would find the
maximum fee I'm willing to pay chump change (throw away money).

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Peter J. Holzer" <[email-masked]>
Date: Wed, 3 Nov 2004 00:19:44 +0100

On 2004-11-01 07:31:09 -0800, Douglas Campbell wrote:
> network. 

I'd expect that, too. Unfortunately our expectations aren't met.

I just tested all the 155k IP addresses which connected during October
to our main MX for MTAmark records.

Results (excluding our own network):

 155173 MTA=unknown
      8 MTA=no
      6 MTA=yes

Well, that's a a bit better than a similar test I did in July, but there
clearly aren't enough MTAmark records yet to bother implementing filters
based on them.

Even worse, while the MTA=yes records seem correct, the MTA=no records
are a bit suspicious:

Host 177.211.151.12.in-addr.arpa not found: 2(SERVFAIL)
10.122.171.136.in-addr.arpa domain name pointer ctsmtpho1.chevrontexaco.com.
19.162.87.192.in-addr.arpa domain name pointer mail.iss.nl.
144.5.87.192.in-addr.arpa domain name pointer relay.surfnet.nl.
16.50.87.192.in-addr.arpa domain name pointer swets-fw1.swets.nl.
Host 13.52.171.194.in-addr.arpa not found: 3(NXDOMAIN)
46.182.41.212.in-addr.arpa domain name pointer d429b62e.adsl.legend.co.uk.
87.225.69.212.in-addr.arpa domain name pointer outbound2.mail.legend.net.uk.

Half of the names seem to have something to do with mail, and one of the
hosts is even called "outbound2". I can't help but think that in these
cases someone created an MTA=no record for the whole network but forgot
to add the MTA=yes records for the mail servers (Happened to me, too: I
posted a record for the main mail server, but forgot the mailing list
server).

I also talked to the postmaster of another Austrian ISP (who happens to
be responsible for 5 of the 6 MTA=yes records) and he said they would
only publish MTA=yes records for their servers, but no MTA=no records for
their dial-up and DSL customers. Which doesn't seem to be very useful to me.

	hp

PS: If someone wants to do similar stats, the script I used is at
http://www.hjp.at/mail/spam/mtamark/mtamark.pl

It expects one IP address per line as input and spits out the MTAmark
record for each IP address. It is quite slow (about 1 second per IP
address on average), so if you want to test lots of addresses you should
split the input into several files and run them in parallel.

-- 
   _  | Peter J. Holzer    | Je höher der Norden, desto weniger wird
|_|_) | Sysadmin WSR       | überhaupt gesprochen, also auch kein Dialekt.
| |   | [email-masked]         | Hallig Gröde ist fast gänzlich dialektfrei.
__/   | http://www.hjp.at/ |   -- Hannes Petersen in desd
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 9 Nov 2004 03:16:29 +0100

> clearly aren't enough MTAmark records yet to bother implementing filters

We have added MTAMARK records to some hundred of our ASP mailservers ;-)

> Even worse, while the MTA=yes records seem correct, the MTA=no records

The most I have seen were wildcard records. Some of them said
    'no DNS yet'
some gave all kinds of information, some had SPF records ;-)

> their dial-up and DSL customers. Which doesn't seem to be very useful to me.

It is useful enough ;-)
We do greylisting and disable greylisting in cases there is a MTA=yes
record. Works very good for connections between our customers or with
e.g. utanet.at servers.

There is native support for MTAMARK in the current sendmail versions.
I hope to have a qmail interface/patch ready by the end of this week.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"