spf-discuss
[Top] [All Lists]

Re: Random stats on how often SPF is checked

2004-02-09 02:37:13
On 8 Feb 2004 at 23:05, Greg Connor wrote:

Here are some stats on how often our SPF exists: macro has been triggered.

This shows an increase in the amount of mailers checking SPF at the 
receiving side.  However, the data might indicate other things as well, 
such as overall spam activity for that day.

(Since all mail coming from *(_at_)altavista(_dot_)com is forged, it's all 
coming from 
spammers at this point :)  Our MX servers for this non-email domain get 
about 3M sendmail connections per day, about 1M of these are bounces coming 
back to <%randomchars(_at_)altavista(_dot_)com> saying the forged message 
could not be 
delivered. )

Same for me and baschny.de. But not as many yet as altavista.com of
course. Even if my domain is pretty unknown, it sadly seems to be used
heavily (around 200k sendmail connections per day with "User unknown"
replies).  I changed my "User unknown" message to

550 5.1.1 User unknown, see http://www.baschny.de/spam/

so that affected users that try to reach the forged sender can read about
the problem where I also refer to SPF.

There was an all-time high of 643 yesterday (Feb 7).  Not quite 1M but it 
shows that SPF is proven to reject forged mail.

Indeed it does.

(...)
 214 28-Jan-2004
 156 29-Jan-2004
 221 30-Jan-2004
 409 31-Jan-2004
 518 01-Feb-2004
 223 02-Feb-2004
 309 03-Feb-2004
 540 04-Feb-2004
 717 05-Feb-2004
 349 06-Feb-2004
 643 07-Feb-2004

Here are similar stats for my baschny.de domain:

 4     Jan 28
 5     Jan 29
 109   Jan 30
 51    Jan 31
 137   Feb 01
 159   Feb 02
 173   Feb 03
 104   Feb 04
 166   Feb 05
 65    Feb 06
 183   Feb 07
 124   Feb 08

Other interesting statistic is the amount of unique DNS-Servers that
made those queries. In my case, 90 different DNS-clients have connected
from 73 different domains. Not bad for a start.

-- 
Ernesto Baschny <ernst(_at_)baschny(_dot_)de>
 http://www.baschny.de - PGP: http://www.baschny.de/pgp.txt
 Sao Paulo/Brasil - Stuttgart/Germany
 Ernst(_at_)IRCnet - ICQ# 2955403

-------
Sender Permitted From: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Latest draft at http://spf.pobox.com/draft-mengwong-spf-02.9.7.txt
Wiki: http://spfwiki.infinitepenguins.net/pmwiki.php/SenderPermittedFrom/
To unsubscribe, change your address, or temporarily deactivate your 
subscription, 
please go to 
http://v2.listbox.com/member/?listname(_at_)©#«Mo\¯HÝÜîU;±¤Ö¤Íµø?¡


<Prev in Thread] Current Thread [Next in Thread>