Subject: Re: Last Call: Anti-Spam Requirements on an SMTP MTA to BCP

From: Tim Salo <[email-masked]>
Date: Mon, 2 Mar 1998 22:00:48 -0600 (CST)

> Date: Mon, 2 Mar 1998 22:12:39 -0500
> From: "Dick St.Peters" <[email-masked]>
> Subject: Re: Last Call: Anti-Spam Requirements on an SMTP MTA to BCP
> 	[...]
> We're _almost_ a small New England ISP - Vermont is only 20 miles east
> of here - and we require that domains resolve.  We have for some time.

What are you requiring to resolve?  (host, domain, MX, ...?)

How different are the answers from DNS and whois?  Are spammers looking
for domains that exist in whois but not in DNS?

Does some legitimate mail have From addresses that don't resolve?

Or, more generally, what's the story for From addresses like those you
mention below, that seem to sort of exist?

> So far today, this has blocked 57 emails "from":
> 	[...]
>    9 <@gateway.24hrplaymates.com.244.216.208.in-addr.arpa:[email-masked]>

% whois 24hrplaymates.com
Playboy Enterprises, Inc. (24HRPLAYMATES2-DOM)
   680 N. Lake Shore Drive
   Chicago, IL 60611
   US

   Domain Name: 24HRPLAYMATES.COM

>    1 <[email-masked]>

% whois rjf.com
Raymond James Financial (RJF-DOM)
   880 Carillon Parkway
   St. Petersburg, FL 33716
   US

   Domain Name: RJF.COM

>    1 <[email-masked]>

% whois freemoney.com
Bassworks Multimedia (FREEMONEY-DOM)
   174 Hunt Circle
   Thousand Oaks, CA 91360
   USA

   Domain Name: FREEMONEY.COM

>    1 <[email-masked]>

% whois greenhart.com
Greenhart Computer Consulting Ltd. (GREENHART-DOM)
   18-201 Silvercreek Pkwy. N.
   Guelph, Ontario N1H 3T4
   Canada

   Domain Name: GREENHART.COM

>    1 <[email-masked]>

% whois neric.com
Chris Barry (NERIC2-DOM)
   #4-2007 West Genesee Street
   Syracuse, N.Y. 13219
   USA

   Domain Name: NERIC.COM

>    1 <[email-masked]>

% whois here.net
Here Services % Reservation Systems (HERE5-DOM)
   50 Water Street  2nd Floor
   Newburyport, MA 01950
   USA

   Domain Name: HERE.NET

>    1 <[email-masked]>

% whois iddqd.org
iddqd (IDDQD-DOM)
   1402 Pine Avenue,Suite 172
   Niagara Falls, NY 14301
   US

   Domain Name: IDDQD.ORG

>    1 <[email-masked]>

% whois home.com
Home Network (HOME-DOM)
   425 Broadway
   Redwood City, CA 94063
   US

   Domain Name: HOME.COM

> It's been worth every cycle, IMNSHO.
> 
> For our clients' domains we have dual off-site secondaries, one her in
> NY state and one in Colorado, so if people have their mail bounce
> because their domains temporarily don't resolve, I have a solution for
> them :)
> 
> Of course, requiring 'from' domains to resolve might force everyone to
> have redundant offsite secondaries, and we'd lose that competitive
> edge.  Perhaps that's not a Bad Thing ...

---

From: "Dick St.Peters" <[email-masked]>
Date: Tue, 3 Mar 1998 12:19:49 -0500

> What are you requiring to resolve?  (host, domain, MX, ...?)

The actual sendmail rule is 

Scheck_mail
 ...
R$*             $: $>3 $1                                       canonify
 ...
R$*<@$*$~P>$*           $#error $@ 5.1.8 $: "518 No such host or domain"

> for domains that exist in whois but not in DNS?

DNS and whois cover different ground.  For example, whois says
24hrplaymates.com exists but does not speak to whether
gateway.24hrplaymates.com exists.  DNS, which could say the latter
exists, doesn't have any records for it.

Spammers look for all sorts of things.  For awhile, about half the
spam delivered here was immediately followed by a request from the
same source for us to relay mail somewhere else.  It's the obvious way
to harvest a crop of open mail relays ... 'obvious', but how many
people out to fight spam thought of it on their own?

> Does some legitimate mail have From addresses that don't resolve?

Sometimes, yes.  How much depends on your definition of 'legitimate'.
There are still systems with underscores in their names - can such
illegitimate systems be the origin of legitimate mail?

Probably the most common kind of legitimate mail that fails the
resolution test is mail with deliberately mangled anti-spam 'from'
addresses: 'From [email-masked]*spam.net', etc.  Our sendmail won't accept
misconfigured mail from our own users.

That has, however, done wonders for cleaning up our users' email
configurations.  A lot more of the replies to their mail make it back
to them.  My subjective estimate, with an admitted bias that I want it
to be true, is that the net effect on legitimate mail has been
positive due to this cleaning up of our outgoing mail.

> Playboy Enterprises, Inc. (24HRPLAYMATES2-DOM)

% host gateway.24hrplaymates.com
Host not found, try again.

> Raymond James Financial (RJF-DOM)

% host 34.rjf.com
Host not found.

> Bassworks Multimedia (FREEMONEY-DOM)

% host freemoney.com
Host not found, try again.

>    18-201 Silvercreek Pkwy. N.

% host greenhart.com
Host not found, try again.

>    #4-2007 West Genesee Street

% host mum.neric.com
Host not found.

>    50 Water Street  2nd Floor

The servers listed for here.net say they are not authoritative for the
domain.  Either they are misconfigured or, more likely, they are just
no longer providing DNS.

>    1402 Pine Avenue,Suite 172

% host iddqd.org
Host not found, try again.

> >    1 <[email-masked]>

% host home.rdc1.sdca.home.com
Host not found.

(I believe the difference between a simple "Host not found" and "Host
not found, try again" is that the former means an authoritative
response "there's no such host", but I'm too lazy to confirm that.)

The DNS resolution test has blocked 63 emails so far this morning, from:

   3 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   6 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
  12 <[email-masked]>
  11 <[email-masked]>
   1 <[email-masked]>
   5 <@gateway.24hrplaymates.com.244.216.208.in-addr.arpa:[email-masked]>
   3 <[email-masked]>
   2 <[email-masked]>
   1 <[email-masked]>
   2 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   1 <[email-masked]>
   7 <[email-masked]>

Since iddqd.org showed up again, twice this time, I took a closer
look.  The messages from <[email-masked]> (yesterday),
<[email-masked]> and <[email-masked]> are being relayed
to us by Netcom mail relays.  Whois gives no indication the mail
domain has any association with Netcom.  The domain was registered
only 2 weeks ago and apparently has already lost its DNS.  Sure looks
like spam.

OTOH, the [email-masked] address looks like a case of legitimate
but misconfigured mail - the system trying to send us the mail is
indeed an epa.gov mail relay.  Perhaps our rejecting the mail will
result in someone helping 'amy' correct her mail configuration, and
heer correspondents will be able to reply to her mail.

--
Dick St.Peters, [email-masked] 
Gatekeeper, NetHeaven, Saratoga Springs, NY, 1-800-910-6671 (voice)
Saratoga/Albany/Amsterdam/BlueMountain/Cobleskill/Greenwich/
GlensFalls/LakePlacid/NorthCreek/Plattsburgh/...
	  First Internet service based in the 518 area code