-----Original Message-----
From: Murray S. Kucherawy
Sent: Tuesday, February 08, 2011 4:00 PM
To: 'Rolf E. Sonneveld'
Cc: ietf-dkim(_at_)mipassoc(_dot_)org WG
Subject: RE: [ietf-dkim] Interesting recent statistics
Good news! Although... we don't know whether the increase is due to
spammers that adopt DKIM or legit
senders adopting DKIM.
We have some hints in the data, since I have some correlation between
DKIM-specific message data and SpamAssassin results. I just need to
build the right SQL query. I'll post again when I have that.
Here you go (remember, February is incomplete and August was probably skewed as
the collection system rolled out):
+----------+--------+------+-------+
| count(*) | spammy | year | month |
+----------+--------+------+-------+
| 56 | 0 | 2010 | 8 |
| 19 | 1 | 2010 | 8 |
| 282 | 0 | 2010 | 9 |
| 548 | 1 | 2010 | 9 |
| 133 | 0 | 2010 | 10 |
| 212 | 1 | 2010 | 10 |
| 54 | 0 | 2010 | 11 |
| 80 | 1 | 2010 | 11 |
| 60 | 0 | 2010 | 12 |
| 51 | 1 | 2010 | 12 |
| 35 | 0 | 2011 | 1 |
| 114 | 1 | 2011 | 1 |
| 23 | 0 | 2011 | 2 |
| 76 | 1 | 2011 | 2 |
+----------+--------+------+-------+
So spammer adoption is outpacing legit adoption (except for December),
according to the criterion that a domain is "spammy" if SpamAssassin thought at
least 25% of signed mail from that domain is spam. (Changing it to 50% barely
changed the count(*) column at all.) This is a count of new domains only, per
month.
That report was based on the From: domain; keying instead on the "d=" domain,
the result is almost exactly the same:
+----------+--------+------+-------+
| count(*) | spammy | year | month |
+----------+--------+------+-------+
| 37 | 0 | 2010 | 8 |
| 17 | 1 | 2010 | 8 |
| 284 | 0 | 2010 | 9 |
| 538 | 1 | 2010 | 9 |
| 122 | 0 | 2010 | 10 |
| 203 | 1 | 2010 | 10 |
| 44 | 0 | 2010 | 11 |
| 78 | 1 | 2010 | 11 |
| 54 | 0 | 2010 | 12 |
| 51 | 1 | 2010 | 12 |
| 31 | 0 | 2011 | 1 |
| 112 | 1 | 2011 | 1 |
| 18 | 0 | 2011 | 2 |
| 74 | 1 | 2011 | 2 |
+----------+--------+------+-------+
In any case, there is a constant stream of new legit domains as well, which is
what we really need.
-MSK
_______________________________________________
NOTE WELL: This list operates according to
http://mipassoc.org/dkim/ietf-list-rules.html