Subject: [Asrg] Statistical Analysis shows SPF should work Pretty Well

From: [email-masked] (Meng Weng Wong)
Date: Thu, 12 Jun 2003 16:24:50 -0400 (EDT)

Executive Summary:

   Matching sender domain with client IP is a strong predictor of spamminess.

   http://dumbo.pobox.com/spam-sensor/analysis01.png

Analysis:

I analyzed 6,810,374 unique deliveries over a two-month period whose
senders claimed to be from aol.com, hotmail.com, and yahoo.com.  Those
deliveries came from 1,885,248 distinct email senders.  I classified
those senders using statistical methods into 1,775,660 spammer
addresses and 109,588 nonspammer addresses.

Of the 1,775,660 addresses which my classifier decided were more
likely to be spammers than not-spammers, 4,188 actually originated
from aol, hotmail, or yahoo.  That is a statistically insignificant
number and reflects more on the imperfection of my classifier scheme
than anything else.  The classifier scheme is described at
http://dumbo.pobox.com/spam-sensor/.

Conclusion 1: aol, hotmail, and yahoo have successfully implemented
outbound antispam technology, ie. ways to ensure that only humans sign
up for their accounts, or limits on per-account outbound message volume.

The analysis is described in detail at http://dumbo.pobox.com/spam-sensor/analysis01.txt

The important result of the analysis is a log/log scatterplot
   http://dumbo.pobox.com/spam-sensor/analysis01.png

Each dot represents one or more sender addresses; the color of the dot
represents whether the domain matched the client IP --- sort of a
proto-SPF, using PTR instead.  There is a collision problem but on the
whole the output communicates pretty well.

Conclusion 2: Client IPs whose PTR do not match their sender domains are
more likely to be spam than not.

But that means a scheme like SPF/DMP/RMX should work nicely.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Kee Hinckley <[email-masked]>
Date: Thu, 12 Jun 2003 23:06:27 -0400

>But that means a scheme like SPF/DMP/RMX should work nicely.

As would turning off your mail server.
How many false positives would such a scheme result in?
-- 
Kee Hinckley
http://www.messagefire.com/          Anti-Spam Service for your POP Account
http://commons.somewhere.com/buzz/   Writings on Technology and Society

I'm not sure which upsets me more: that people are so unwilling to accept
responsibility for their own actions, or that they are so eager to regulate
everyone else's.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Vernon Schryver <[email-masked]>
Date: Thu, 12 Jun 2003 20:49:32 -0600 (MDT)

> From: [email-masked] (Meng Weng Wong)

> ...

Success is certainly is fleeting.  See
  http://www.google.com/search?q=hotmail+dav
  http://news.google.com/news?q=hotmail+dav
  http://www.vnunet.com/News/1141514
I've also seen recent reports from usually reliable sources that
Microsoft's account creation mechanism has been "scripted."

A summmary of all of that is that in recent weeks spammers have been
significant spam through Hotmail systems.

This goes to show that questions (not just statements) about whether
characteristics of spam (or spam defenses) occur some of the time or
most of the time should be view critically.  Measurements of spam
can be useful for showing that a characteristic (practically?) always
or never occurs in spam or that a tactic of spammers or spam defenses
always or never works.  Concluding much from a measurement that
says "X happens 90%" (or 9%) is often an error.

> ...

Does that imply that your definition of "work nicely" allows as many
as 50% false positives?

Vernon Schryver    [email-masked]
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 12 Jun 2003 22:58:04 -0400

At 04:24 PM 6/12/2003 -0400, Meng Weng Wong wrote:
>[..]

We already know that, that's why people are pushing the RMX-like proposals 
to make sure that the basic flaw in SMTP is taken care off. However, there 
are still some gray areas such as people who are traveling, and domains 
providing email service for other domains.

>[..]
>  The classifier scheme is described at

Your classifier scheme seems to work similar to the scheme used by 
TitanKey's system. In TitanKey's system, a "550" is issued to every message 
based on the assumption that spammers clean their lists because of SMTP 
errors. Then a challenge is issued to the receiver and the regular C/R 
process takes off. In your system, a "4xx" transient error code is issued. 
This is based on the assumption that:
o Spammers won't retry after they get a deferral

During the discussion about TitanKey's system, many people have stated that 
these basic assumptions have no valid data backing them up. Unless someone 
here is an "honest" spammer [sic], no one in the group can really provide 
any data as to what goes on behind the scenes on the spammer side. The 
advantage of your system is the same as TitanKey: the message is rejected 
before its received, thus reducing costs of dealing with storing the 
processing such message. However, whether the assumption here tends to be 
correct or not, is beginning to crop up all over, like you mentioned on 
your page. It would be interesting to see what spammers are doing but in 
any case this solution is probably a temporary fix.

>up for their accounts, or limits on per-account outbound message volume.

See my previous message some time ago about Hotmail's scripting abilities. 
Providers, especially the free ones, have a long way to go to reduce 
outbound message volume.

>[..]

That's why AOL rejects email from addresses without PTRs (see 
http://postmaster.info.aol.com/standards.html)

>But that means a scheme like SPF/DMP/RMX should work nicely.

It is very useful to see real-life data once in a while. Thanks.

Yakov

---

From: Yakov Shafranovich <[email-masked]>
Date: Fri, 13 Jun 2003 01:48:56 -0400

>   http://www.vnunet.com/News/1141514

This also appeared on SlashDot story 
(http://yro.slashdot.org/yro/03/06/08/0257203.shtml).

>Microsoft's account creation mechanism has been "scripted."

By contrast Yahoo is employing a Turing test process to test sign ups. I 
wonder if Hotmail would use such process, would that reduce the problem? 
Probably not, as long as the WebDAV facility is turned on.

>says "X happens 90%" (or 9%) is often an error.

This is also true for the underlying assumption that is discussed on Wong's 
webpage regarding using transient failure codes (4xx) to stop spammers.

---

From: Vernon Schryver <[email-masked]>
Date: Fri, 13 Jun 2003 07:14:30 -0600 (MDT)

> From: Yakov Shafranovich <[email-masked]>

> wonder if Hotmail would use such process, would that reduce the problem? 

Obviously not.

Computers will not be able to administer anything that might reasonably
be called a Turing test until they can pass one.  For the immediately
foreseeable future, any text based test administered by computers will
be as vulnerable to "scripting" as one based on pictures.

---

From: Barry Shein <[email-masked]>
Date: Fri, 13 Jun 2003 17:54:55 -0400

To use an analogy, this approach still strikes me as trying to cut
traffic down 25% on a four lane highway by blocking one lane with
orange cones.

The traffic will just flow around it.

And "studies" showing that 25% of the traffic does in fact use the
lane to be blocked aren't really persuasive, which is how these
studies claiming that spammers frequently forge big domains into their
heads strike me.

It's not like spammers can't change their behavior, they often do, and
this one isn't even hard to change.

I think it's all somewhat similar to what John Gilmore is usually
credited with saying; that censorship on the internet is viewed as
damage and routed around. This isn't censorship (anyone who jumps on
that gets my idiot award), but it's very similarly flawed, it's too
easy to just route around this to get excited about it.

On the other hand these schemes are possibly useful outside of the
spam context as a weak form of authentication (hence, I think, outside
of the scope of this research group.)

For example, did this letter from my bank actually come from my bank?

If it's just a notice that there's a special on car loans this month
it's comforting to know it's probably really from my bank and clicking
the link probably won't take me to a throbbing H0T L0LlTAZ!!! site.

However, if it demands I respond with my account and PIN numbers I
think it would be better to be suspicious even if it did appear to
have come from my bank by this method of verification. So, a weak
authentication scheme.

But I think its potential effect on spam is minimal.

-- 
        -Barry Shein

Software Tool & Die    | [email-masked]           | http://www.TheWorld.com
Purveyors to the Trade | Voice: 617-739-0202        | Login: 617-739-WRLD
The World              | Public Access Internet     | Since 1989     *oo*
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Meng Weng Wong <[email-masked]>
Date: Sat, 14 Jun 2003 01:58:58 -0400

On Fri, Jun 13, 2003 at 05:54:55PM -0400, Barry Shein wrote:
| 
| It's not like spammers can't change their behavior, they often do, and
| this one isn't even hard to change.

I agree; we must play good chess.  If SPF/DMP/RMX/... goes in, what do
you think the spammers will do next?

In other news, is anyone else getting list messages delivered late?
I'm seeing delays of up to a few hours.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sat, 14 Jun 2003 22:52:50 -0400

>I'm seeing delays of up to a few hours.

I have been having delays also for a while. Perhaps contacting the IETF 
might help.

---

From: "Alan DeKok" <[email-masked]>
Date: Sun, 15 Jun 2003 09:31:14 -0400

> | this one isn't even hard to change.

  The fact that spammers can adapt to measures used to fight them
doesn't mean we should give up the fight, as a lost cause.

> you think the spammers will do next?

  Exactly.

  There is no "magic bullet", or "weapon of mass destruction" which
may be used to fight spam.  The ONLY possible method we can use is to
gradually implement a series of changes to the network, and our use of
it, which will make it unproductive to send spam.  These measures
will, of course, have a cost for the non-spammers, but that cost
SHOULD be less than the cost that they are already bearing, of
fighting spam.

  The rabid fight against any anti-spam measure which isn't perfect is
something I've never understood, except from the "ulterior motives"
perspective.

  Alan DeKok.

---

From: Yakov Shafranovich <[email-masked]>
Date: Sun, 15 Jun 2003 11:44:05 -0400

>SHOULD be less than the cost that they are already bearing, of

Agreed. The spam problem might never go away, but these changes can 
gradually reduce the problem.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:07:49 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 3) conclude that because technical solutions have not solved spam in
|    the past, they cannot possibly solve spam in the future; this is
|    the "spam is ultimately a social / technical / legal problem" camp;

er, that should be "social / economic / legal".  Sorry.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:28:25 -0400

On Mon, Jun 16, 2003 at 04:33:47PM +0200, Markus Stumpf wrote:
| 
| spammers will switch back to empty envelope senders.

The original DMP I-D says, in the case of a blank envelope sender,
test using the HELO domain instead of the envelope sender domain.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:08:43 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ...some objections to SPF have come from people who
| 
| 5) misunderstand some technical detail of SPF, and take up arms
|    against a chimera;

(5): SPF doesn't say anything about RFC822 header addresses.  It only
has to do with the RFC821 envelope sender address.  You may still
forge whatever headers you wish.  Forwarding systems and kiosks can
easily achieve SPF compliance by using a sender rewriting scheme
(SRS); I am developing a simple I-D to describe one possible SRS.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:17:05 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ... some objections to SPF have come from people who
| 
| 8) do not see beyond the short future that is explicitly described;
| 

Of course spammers will react to SPF.  If you can think of specific
actions they will take, let's discuss them.

I've already thought of one response; the "throwaway domain" scenario
is addressed in the FAQ at

  http://spf.pobox.com/faq.html#noprevent

Many eyes make bugs shallow, process of dialectic, yadda yadda.
Help me make this proposal the best that it can be.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:12:57 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ... some objections to SPF have come from people who
| 
| 7) assert flatly that it won't work; assert that similar approaches
|    have been proposed and, broadly, "failed"; therefore so will SPF;
| 

Damian Conway: "if nothing you've tried so far has worked, try
something new."  SPF counts as new.  I have seen several people
criticize SPF as unworkable.  I invite them to propose a specific
alternative.  If they will not, then these people won't lead, and they
won't follow; they need to get out of the way.
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:04:18 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ...some objections to SPF have come from people who
| 
| 1) get stuck trying to define spam, and because they can't define it,
|    claim that nobody else can either, and so cannot imagine how to
|    solve a problem they cannot frame;
| 
| 2) champion a personal definition of spam, and attack technical
|    solutions because those solutions do not match their definitions;

(1) and (2) are a problem of definition.  SPF avoids the quicksand of
definition entirely.  SPF is merely an *extension* of SMTP which
*closes a security hole*; it improves the veracity of sender addresses
among consenting hosts.  It also fights worms and viruses; it also
fights forgery.  Right now lots of our customers misconfigure their
home machines as pobox.com, and send bounce messages using From:
[email-masked].  The double-bounces end up in my mailbox.  SPF
helps solve this problem also.  If SPF works against spam, what a
happy coincidence!
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:18:34 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ...some objections to SPF have come from people who
| 
| 9) prefer a different approach;
| 

This is a perfectly respectable objection.  In this war on spam we can
use as many weapons as we can get.  We don't have to pick just one
solution; they can work together.  It's time to review the proposals
and unite behind the best ones.  If you evaluate the proposals along
the dimensions of scalability, backward-compatibility, transparency,
level of inconvenience to users, universal applicability,
implementation timeframe, and cost of new code and configuration, SPF
comes out near the head of the pack.

---

From: Markus Stumpf <[email-masked]>
Date: Mon, 16 Jun 2003 16:33:47 +0200

> you think the spammers will do next?

spammers will switch back to empty envelope senders.
Then all people will start to block bounces.
This causes the eMail-system to become totally unreliable.

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:11:35 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ...some objections to SPF have come from people who
| 
| 6) recognize that you can't make an omelette without breaking eggs;
|    but, fearing that theirs are the eggs to be broken, storm the kitchen;

This is a political problem, and will ultimately be answered by the
industry.  Damian Conway said today: "everything that brings joy also
brings pain."  The pain of a world where SMTP permits forgery,
anonymity, and spam is greater to me than the pain of a world where
SASL+SMTP+SPF require authenticated logins to home servers.  I expect
leading ISPs to act for the majority of their users, and I expect the
majority of the users to agree with me.  SPF tries to cushion the blow
to those with fragile eggs by providing the mechanism of Sender
Rewriting and by advocating SASL.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:07:03 -0400

On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:
| 
| ...some objections to SPF have come from people who
| 
| 3) conclude that because technical solutions have not solved spam in
|    the past, they cannot possibly solve spam in the future; this is
|    the "spam is ultimately a social / economic / legal problem" camp;
| 
| 4) observe that no single solution is perfect, and fall into despair;

(3) is an objection unique to pessimists.  We technical types, being
professional practitioners of pessimism, must be especially wary.  We
have nothing to lose by trying a new approach.  Optimism in this case
is more productive than pessimism.  People who assert that technical
approaches won't work are sticking their necks out: the statement
can't be proven, only disproven.  What is the use of a newborn baby?

Let the social / economic / legal solutions proceed apace; we should
not abandon the technical track.

(4) is a problem for those who are both pessimists and perfectionists.
An 80% solution that works is better than a 100% solution that doesn't
exist.  Spam costs ISPs money; they are looking for answers today.

---

From: Meng Weng Wong <[email-masked]>
Date: Mon, 16 Jun 2003 12:01:58 -0400

On Sun, Jun 15, 2003 at 11:44:05AM -0400, Yakov Shafranovich wrote:
| 
| Agreed. The spam problem might never go away, but these changes can 
| gradually reduce the problem. 
| 

Most objections to SPF have come from people who

1) get stuck trying to define spam, and because they can't define it,
   claim that nobody else can either, and so cannot imagine how to
   solve a problem they cannot frame;

2) champion a personal definition of spam, and attack technical
   solutions because those solutions do not match their definitions;

3) conclude that because technical solutions have not solved spam in
   the past, they cannot possibly solve spam in the future; this is
   the "spam is ultimately a social / technical / legal problem" camp;

4) observe that no single solution is perfect, and fall into despair;

5) misunderstand some technical detail of SPF, and take up arms
   against a chimera;

6) recognize that you can't make an omelette without breaking eggs;
   but, fearing that theirs are the eggs to be broken, storm the kitchen;

7) assert flatly that it won't work; assert that similar approaches
   have been proposed and, broadly, "failed"; therefore so will SPF;

8) do not see beyond the short future that is explicitly described;

9) prefer a different approach;

10) or have a personal reason to see spam survive and grow.

---

From: "Jon Kyme" <[email-masked]>
Date: Mon, 16 Jun 2003 21:51:43 +0100

> On Mon, Jun 16, 2003 at 12:01:57PM -0400, Meng Weng Wong wrote:

I don't know if this is just me but I find this thread (these threads)
confusing. Perhaps it might be better to stick to
a single subject... and/or a smaller number of longer posts,
rather than creating a new subject for every paragraph.

Also, I find multiple IDs in the References unhelpful.
(It's "discouraged" in RFC2822)

Or maybe I'm missing something.

Thanks anyway.

---

From: Barry Shein <[email-masked]>
Date: Mon, 16 Jun 2003 17:17:09 -0400

> won't follow; they need to get out of the way.

With all due respect (and it isn't much) you're heaping the bullshit
just a bit too high for my tastes.

-- 
        -Barry Shein

---

From: Barry Shein <[email-masked]>
Date: Mon, 16 Jun 2003 17:15:45 -0400

>   http://spf.pobox.com/faq.html#noprevent

Oh right this is the smarmy "brushing my teeth doesn't prevent
cavities" answer (along with several other, similar remarks) which
struck me more like the repartee' of a used car salesman than someone
who wishes to be taken seriously.

One problem, as I see it, are the ever increasing number of zomboid
thrall servers; PC's with viruses which turn them into spam delivery
slaves.

-- 
        -Barry Shein

---

From: Vernon Schryver <[email-masked]>
Date: Mon, 16 Jun 2003 18:32:01 -0600 (MDT)

> Most objections to SPF have come from people who ...

I've seen seemingly endless talk recently about the characteristics
of people who don't like SPF and various bits of what I assume are
deep philosophies, but nothing about what SPF is.

In poking Google, I found http://spf.pobox.com/ 
From that page, I found this statement on the "executive summary" in
http://spf.pobox.com/execsumm.html

  SPF is not patent-encumbered.

As I understand such things, absolutely no one can flatly say that
anything is not patent-encumbered.  Submarine patents are always a worry
even after a professional patent search.  That page also says that SPF
is less than 2 weeks old.  How can anyone claim there are no existing
patents on SPF?  I thought a patent search required noticable real money
and far more time than a week or two.  Saying that SPF is unencumbered
sounds like an unconditional and unlimited offer of indemnification
should a patent surface.  Are you sure you want to assume what could
be many-multi-million dollar liability?

In plowing through the links on http://spf.pobox.com/ I find many
statements that seem obviously false to me.  For example, the
characterization "The Problem With STMP" seemss wrong at least about
the nature and history of SMTP.  And so on....

I looked at several of the links on http://spf.pobox.com/ without
gaining the faintest idea of what SPF is.  I found many assurances
that SPF will fix spam and that realsoonnow there will be a technical
specification, but few technical clues.

I did find http://spf.pobox.com/dns.html which seems to involve odd
notions of which characters are valid in DNS names and a reasonable
notion of names that are not already in use.  That page suggests (but
does not seem to come out and say) that SPF is a version of what Paul
Vixie wrote about years ago about Jim Miller's 1998 idea and what
others have written about since but with a few trivial tweaks such as
the use of TXT RRs.  If that is accurate, then SPF may be based on
the false notion that many (or any) major ISPs object or could be
forced to object to people sending mail ossensibly from their domain
names but via unrelated SMTP clients.

I also looked at 
    http://dumbo.pobox.com/spam-sensor/analysis01.png
    http://dumbo.pobox.com/spam-sensor/analysis01.txt
    http://dumbo.pobox.com/spam-sensor/
and found statistical jargon but little statistical analysis, lots
enthusiasm, and no technnical discussion about the nature of SPF.

See
https://www1.ietf.org/mail-archive/working-groups/asrg/current/msg04508.html
for Paul Vixie's old vers version, not because it is wonderful,
best, authoritative, final, or even particularly good, but only in
the hope of defusing some of the hype.

Ob.Philosophy: What is it about spam that brings out the passion to convince
  and convert?  Or maybe it's just that recent arrivals on the
  DDN Protocol Suite scene are not of the old school that believed
  the best and only interesting sales presentations involve technical 
  details and running code.

---

From: "Jon Kyme" <[email-masked]>
Date: Tue, 17 Jun 2003 11:11:17 +0100

>   http://spf.pobox.com/faq.html#noprevent

Doesn't this entire proposal tend to a blacklist?

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 17 Jun 2003 13:22:33 +0200

> test using the HELO domain instead of the envelope sender domain.

Wow ... how's the weather on your planet?
Out of 7394 connections on one of our mailservers that is closed to
customer access 6789 had non matching (the hostname) HELO arguments.

Most HELO arguments are pc01 and the like.
On our MX mailservers the ration is similar, but of course the are a lot
of spammers that fake them, but I intentionally made the test on a non
MX mailserver.

So you want to force about 90% of all mailserver administrators (most of
the clueless) to change the configuration of their mailserver? Have fun.

	\Maex

---

From: Dave Crocker <[email-masked]>
Date: Tue, 17 Jun 2003 08:29:53 -0700

> Most objections to SPF have come from people who

Note that this summary does not discuss technical concerns, but simply
attacks and dismisses those who raise objections.

Given that ASRG is intended to conduct technical discussion and that
that requires responding to technical concerns with serious, technical
answers, the main objection to SPF is that so far it is not a serious
technical effort.

If that ever changes, it might (or might not) be worth serious
consideration.  However the best path, for now, is to avoid feeding a
topic that is focused on dismissing criticism, rather than responding
to them seriously.

d/
--
 Dave Crocker <mailto:[email-masked]>
 Brandenburg InternetWorking <http://www.brandenburg.com>
 Sunnyvale, CA  USA <tel:+1.408.246.8253>, <fax:+1.866.358.5301>

---

From: Dave Crocker <[email-masked]>
Date: Tue, 17 Jun 2003 09:39:22 -0700

d/

---

From: "Eric Dean" <[email-masked]>
Date: Wed, 18 Jun 2003 11:11:37 -0400

I have seen a rather dramatic increase in the amount of spam coming from
spoofed senders using bogus email addresses.  About 3% of the total email
(including valid email) that makes it through our front-line that filters
out bogus-domains..HELO..whatever winds up getting filtered due to a bogus
sender based upon an SMTP reject from the challenge message.

I'm wondering if the increased threat of litgation by companies such as
Microsoft, AOl, Yahoo...are forcing spammers to further anonymize
themselves.

---

From: Yakov Shafranovich <[email-masked]>
Date: Thu, 19 Jun 2003 14:13:58 -0400

>the clueless) to change the configuration of their mailserver? Have fun.

Check the RFCs, but I believe that the domain in HELO command cannot be 
relied upon for checking.