On Fri, 2009-01-16 at 09:14 -0500, Rich Kulawiec wrote:
My point was not that this would prevent abuse of your domain.
Rather
that it is stupid to register information which is intended to go
some
way to prevent domain abuse, and then send messages which appear to
be
such abuse.
An SMTP reject is not a mail message.
But more broadly, you could have stopped after the first clause:
*nothing* you register will prevent domain abuse if someone (or
something)
is determined to inflict it, since whatever you've done can simply be
ignored (and probably will be). Besides, domain abuse is not a
systemic,
persistent problem; spam, including backscatter/outscatter as one of
its variants, is, which is why (I believe) this RG exists.
I'm not sure where I was promoting anything. Ian wrote about SPF and
DKIM. I gave a couple of example of domain for which SPF information had
been registered, but the owners of the domain were going against their
own action. (In one case it was the domain owner's agent who probably
added the SPF information). I said nothing about the value or otherwise
of SPF for domain abuse.
Having said that, since we registered SPF information for our domain,
the amount of backscatter seems to have been dramatically reduced. I'm
talking about certainly a factor of 10, and perhaps much higher (it
would be some work to verify this). I don't know if this is because:
- receivers are using SPF information to reject at, say, MAIL FROM, or
otherwise
- spammers avoid forging return paths with domains with SPF info
Roughly 15% of message from the outside world which we receive are
suffering SPF failures (about 3:1 soft fails to hard fails, and about
15% of the failures are for our own domain, typically as a result of
using the same address for originator and recipient).
So, I suspect that the first of the reasons is playing a significant
part in reducing backscatter.
_______________________________________________
Asrg mailing list
Asrg(_at_)irtf(_dot_)org
http://www.irtf.org/mailman/listinfo/asrg