Subject: [fwtk-users] Re: Smap Message: peer dropped connection

From: Ted Keller <[email-masked]>
Date: Sat, 1 Dec 2001 11:54:40 -0500 (EST)

Well I have included a rendition of Rick's code in my version of smap.  It
caught an additional 300+ spammers from aol and hotmail for part of a
week.  That's still a small part of my overall spam filters (we tend to
catch some 30,000 spammers - but I'll take it!  It's fast and efficient -
and save the internal scanning of the mail body.

With regard to the ongoing discussion, we may want to compile a list of
the major e-mail services where the code as implemented is valid.  That we
we can all benefit from the anti-spam feature this provides.  Then we
could also compose an alternative list where the mx lookup may be
beneficial.  From these, we can determine if the mxlookup feature is
beneficial.

ted keller

On 28 Nov 2001, Tony Gale wrote:

> On Wed, 2001-11-28 at 00:35, Rick Murphy wrote:
> > At 09:38 AM 11/27/01 +0000, Tony Gale wrote:
> > >I haven't looked into the code, but am going from the description above.
> > >I believe the "correct" way to do this check is to look up the MX record
> > >for the envelope senders domain and check it against the address of the
> > >sending system.
> > >
> > >Using a reverse dns lookup is much more likely to fail and to give an
> > >incorrect result.
> >
> > For the big ISPs that is being used on, that's not the case. A big ISP's
> > outgoing SMTP servers aren't necessarily the same as their incoming servers
> > - but they're very likely to have a valid reverse lookup in their own domain.
> >
> > All the patch does is to say that if you're trying to send mail with an
> > envelope sender of "[email-masked]", you *must* be coming from a host with a
> > valid reverse DNS somewhere in the yahoo.com domain. So far, that works
> > well for detecting the most common forged domains.
>
> The contra-argument being that some ISPs don't allow you to establish a
> reverse DNS for an IP range they have allocated to you.
>
> So, it would be best to do both tests, and catch virtually everyone.
>
> Thanks
>
> -tony
>
>
>
> ---
> You are currently subscribed to fwtk-users as: [email-masked]
> To unsubscribe send a blank email to [email-masked]
>

---
You are currently subscribed to fwtk-users as: [email-masked]
To unsubscribe send a blank email to [email-masked]