Subject: reject smtp connections if no valid reverse dns?

From: Benjamin LaHaise <[email-masked]>
Date: Mon, 22 Jul 2002 12:26:05 -0400

Hey folks,

In my attempts to deal with the massive increase in spam lately, I've 
noticed a number of messages arrive from mail servers that do not have 
correct reverse DNS mappings.  Any chance of getting a flag for this in 
smtpserver.conf, or am I just being blind and not finding it?

		-ben
-- 
"You will be reincarnated as a toad; and you will be much happier."
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Matti Aarnio <[email-masked]>
Date: Mon, 22 Jul 2002 21:34:43 +0300

> smtpserver.conf, or am I just being blind and not finding it?

  I don't support the school of thinking that reverse DNS data is
  mandatory, but...  there are couple ways to achieve it.

  If you configure the compilation, and smtpserver.conf to use
  tcp-wrapper, then there is possibly a way with tcp-wrapper
  for doing it...   It is something obscure -- "UNKNOWN" ?
  I suggest that the response (rejection) given by the server
  is set into

  hosts.allow:
   smtp-receiver: ALL@KNOWN

  hosts.deny:
   smtp-receiver: ALL@UNKNOWN : echo "450 4.7.1 IP address reverse failure,
	connection unacceptable	presently."

  Or something of that effect -- possibly ALL@PARANOID to be allowed,
  and ALL@ALL to be denied, but I am not sure of which way those files
  are used -- deny first, or allow first ?

  Smarter approach would be one which allows delivery to POSTMASTER,
  but won't like it for anybody else..  Carefull separation of NOERROR
  without data and NXDOMAIN, versus timeouts, et.al. (400 vs. 500 series
  codes, and all that)  --  lack of which separation I consider biggest
  infrastructure lack of sendmail...

  However that needs some additional code, I think.

  What I do to combat spam is reception content filter.  It rejects
  all messages smelling of HTML, and is amazingly effective way.
  Extending it to cover spam-assassin would be even more effective,
  but my time has been quite taken up lately...

-- 

/Matti Aarnio	<[email-masked]>
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]

---

From: Benjamin LaHaise <[email-masked]>
Date: Mon, 22 Jul 2002 14:42:53 -0400

>   but my time has been quite taken up lately...

Filtering html was effective for quite a while, but they seem to have 
adapted.  Most of the spam that isn't being caught now is text only 
with reasonable headers (with valid, even forged From:).  Lately the 
regexps I use don't even catch the similar-but-different variations 
on the common scam mails.  Such a pain....

		-ben

---

From: [email-masked]
Date: Thu, 25 Jul 2002 23:05:55 -0400

>on the common scam mails.  Such a pain....

My thinking is that neither filtering against "correct reverse
DNS data" nor filtering HTML are valid ways to combat spam. A lot
of servers have wrong reverse DNS data (forward != reverse DNS,
especially if you consider some servers are .eu.org/.dhs.org hosts
with no possibility of getting correct or even existing reverse DNS).
And some HotMail users (and perhaps other) configure their accounts to
always send HTML.

(I am also using content-based filtering, and yes, I also notice that
my filters are failing a lot more recently.)

-- 
Ambrose Li  <[email-masked]>   http://trends.ca/~acli/
                                              http://www.cccgt.org/
A good style should show no sign of effort;
  what is written should seem a happy accident. - Somerset Maugham
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to [email-masked]