Spammers Most Likely Users Of E-Mail Authentication (TechWeb) [LWN.net]

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 13, 2005 16:33 UTC (Wed) by elanthis (guest, #6227)
Parent article: Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

This isn't news, really. E-mail authentication is not an anti-spam measure. The very name implies that; it's "authentication," not "authorization."

Combine an authorization service - like a real-time blacklist - with authorization, and then you have an anti-spam solution. The authorization allows you to know with certainty where the mail came from, and then you can compare that with the blacklist. Authorization forces spammers to use their own domains, and then you can just blacklist the whole domain. No more need for blacklisting individual hosts and trying to figure out which host a spam came from (think relays) and so on.

to post comments

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 13, 2005 16:48 UTC (Wed) by bfields (subscriber, #19510) [Link] (8 responses)

Combine an authorization service - like a real-time blacklist - with authorization, and then you have an anti-spam solution.

Also, it solves the problem of bounces going to the wrong address, doesn't it? If people stopped sending bounces when they couldn't authenticate the from address, that'd cut down significantly on my "spam", much of which is just automatic responses to mail that someone else sent with my from address.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 13, 2005 17:00 UTC (Wed) by dwmw2 (subscriber, #2063) [Link] (2 responses)

If people stopped sending bounces when they couldn't authenticate the from address, that'd cut down significantly on my "spam", much of which is just automatic responses to mail that someone else sent with my from address.

Alternatively, you could just stop accepting those bounces to mail you didn't send. See my configuration, SES, or BATV for more information.

The simple principle is that you stop sending MAIL FROM:<your@address.here> and always send from a timestamped, hash-signed address. Then you stop accepting bounces to the 'raw' address.

Far more effective than SPF, and doesn't involve throwing away valid mail, like SPF does. See http://david.woodhou.se/why-not-spf.html for further discussion of that.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 15, 2005 15:23 UTC (Fri) by giraffedata (guest, #1954) [Link] (1 responses)

That method has a serious drawback, applied unilaterally -- it defeats white lists. Every mail is from an address the recipient has never seen or sent to before. It also screws up various other email sorting on the receiver's end.

I use a simplified version of that -- I always include my name in the From: header (in the conventional manner). Bounce messages usually contain a copy of the headers. If I see a From: header with my email address but not my name, I know I did not send it. Spammers rarely have both my name and my address.

This is a filter just for my personal mailbox, of course.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 18, 2005 7:58 UTC (Mon) by farnz (subscriber, #17727) [Link]

Most whitelisting is on the Internet message "From:" header, not on the SMTP "MAIL FROM:" header. Thus, you tend not to break whitelists, but you do ensure that anything that harvests your "From:" header for spamming doesn't trigger bounces back to you, as you know that that address never accepts bounces.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 13, 2005 17:10 UTC (Wed) by TwoTimeGrime (guest, #11688) [Link] (4 responses)

> If people stopped sending bounces when they couldn't authenticate the from
> address, that'd cut down significantly on my "spam"

I just stopped accepting all mail from parties where I couldn't validate the from address. That elimitated about 70% of my spam. There's still a lot of spam sent with fake addresses.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 15, 2005 15:16 UTC (Fri) by giraffedata (guest, #1954) [Link] (3 responses)

>I just stopped accepting all mail from parties where I couldn't validate >the from address. That elimitated about 70% of my spam. And plenty of your ham, too. Not many people hate spam enough to do that. In fact, you're most of the way toward the ultimate spam solution -- don't accept any mail at all.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 16, 2005 7:34 UTC (Sat) by dwmw2 (subscriber, #2063) [Link] (2 responses)

And plenty of your ham, too. Not many people hate spam enough to do that. In fact, you're most of the way toward the ultimate spam solution -- don't accept any mail at all.

Not really. You don't lose much ham by rejecting mail which has an invalid reverse-path, and in the cases that you do it tends to improve the actual communication.

Consider an analogy... if you are sending me a letter by snail mail and you accidentally put an invalid return address on it, how am I ever going to reply or actually manage to have a conversation with you? It's much better for that letter never to leave your local post office where your postie knows you and will hand it back to you.

That's basically what happens when my mail servers reject a mail from an invalid recipient. Most of the time it's actually spam, and the spambot just moves on to its next victim. But on the rare occasion that it's actually a genuine mail from someone who has misconfigured their mailer, the fact that I reject their mail means that their own mail server can tell them about it. If I'd accepted the mail, that chance for them to fix the problem would have been lost.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 16, 2005 17:44 UTC (Sat) by giraffedata (guest, #1954) [Link] (1 responses)

I guess you're talking about a different kind of validating the from address.

The context of this article is SPF, which is about determining that a From: address in an email, while it may be a valid email address, is not the address of the person who sent the email.

But while SPF provides a way to prove the From: address is genuine, most ham doesn't participate in SPF, so one wouldn't want to reject mail just because SPF failed to validate the from address.

Spammers Most Likely Users Of E-Mail Authentication (TechWeb)

Posted Jul 18, 2005 7:54 UTC (Mon) by farnz (subscriber, #17727) [Link]

SPF validates the "MAIL FROM:" part of the SMTP protocol. Unlike Sender ID, it has nothing to do with the "From:" header of the mail message.

A compliant SMTP server is supposed to return bounces (not rejects) to the address given in "MAIL FROM:"; spammers don't want bounces, so they tend to use false addresses in "MAIL FROM:", while legitimate users do want bounces, so they use genuine addresses in "MAIL FROM:"