| |||||||||||
|
| |||||||||||
Going Upstream to Fight Spam (Wired)Going Upstream to Fight Spam (Wired)Posted Jan 21, 2004 12:33 UTC (Wed) by copsewood (subscriber, #199)Parent article: Going Upstream to Fight Spam (Wired) I'm confident enough that this proposal will improve matters to feel it's worth my while to be spending a few days writing code which implements the SPF spec. There is a very good incentive for domain owners to publish SPF records: the fact that spammers will have their unwanted mail more easily blocked if they try to forge it as if it were coming from your domain. It only needs a few of the larger domains to publish SPF records to prevent forged AOL, Hotmail and Yahoo addresses from getting through. This gives MTA admins a good incentive to filter using SPF as it cuts down on the incoming spam. Yes this will drive spammers into using non SPF-publishing domains, but this will make life progressively more difficult for non SPF publishing domain owners. Eventually all domains that want mail to be accepted and manageable will have to publish, including spammers, who, as another comment has pointed out, will then be more easily blacklisted using conventional means. Another benefit of this is that it will take away the financial incentive offered by spam houses to virus and trojan writers who create and distribute illegal software that converts broadband Windoze boxes into spam relays.
(Log in to post comments)
Going Upstream to Fight Spam (Wired) Posted Jan 21, 2004 13:35 UTC (Wed) by nowster (subscriber, #67) [Link] Problem with this scheme is:User has mail account on ISP1, but cheap dialup account on ISP2. Uses ISP2 to pick up mail from ISP1's POP3 server, and send out mail using ISP2's SMTP server or using their own SMTP server (especially Linux users). Can't use ISP1's SMTP server as they're not on ISP1's IP addresses, and ISP1 denies relaying for external IPs in order not to be a spam relay.
Going Upstream to Fight Spam (Wired) Posted Jan 21, 2004 18:23 UTC (Wed) by copsewood (subscriber, #199) [Link] No one is pretending that this one can be implemented without various other aspects of the mail infrastructure requiring upgrade. The reason that 4000 domains have already published SPF records, with this number doubling every few weeks, is because the current infrastructure is being increasingly trashed by the spammers. I for one can no longer guarantee that all of my wanted incoming mail will be looked at any more (false positive spam detects), or that all of the 200 mails rejected by my system daily will be bounced (I don't want to hassle those whose legitimate addresses are forged on the spam I receive).There will be users such as those you describe who will need some kind of authenticated SMTP relay service, or SMTP after POP. Those who send out mail for one ISP account from another ISP's dialup are likely to be smart enough to figure out how to upgrade to authenticated SMTP for outbound mail using the appropriate relay. Using a dialup machine for direct to MX mail is a bad idea, as it is likely to result in blocks from existing blacklists . These who don't want to know how to upgrade are likely to prefer to use web mail anyway which shouldn't be adversely affected. Yes a few of the less competent ISPs who can't be bothered to upgrade will probably go out of business. Question of not being able to make omlettes without breaking some eggs. What is likely to be a more significant problem is that mail forwarding will break and needs more significant redesign at the MTA level i.e. to rewrite the envelope headers of forwarded mail so as to create a reasonable path for bounces. Interestingly, one of the companies most active in introducing SPF is a legitimate mail-forwarding company ( pobox.com ). SPF is being rapidly adopted because it is likely to lead to an immediate improvement for those who are worst affected by spam and by having their email identities stolen by spammers.
Going Upstream to Fight Spam (Wired) Posted Jan 22, 2004 18:28 UTC (Thu) by sfeam (subscriber, #2841) [Link] Why is this a problem, so long as ISP2 has it's own SMTP serverappropriately listed? But yeah, running your own server is likely to be difficult.
|
|||||||||||