spf-discuss
[Top] [All Lists]

Re: Re: AOL's impatient servers

2004-06-28 07:57:22
You really think spammer do not know about every trick to block spam. Heck
if they get by filters that do regular updates I am sure they can figure out
that a delay in sending is a new feature. This only slows them down.

Many spammers sending out spam also send it to some of their own valid
addresses. When these addresses do not get their spam they know it is being
block and by who.

I have done test and blocked spam a variety of ways. Shortly after being
successful on many occasions the same spam comes in with a variation that
get by the blocking. It is a game that just goes on and on. Spf and sender
authentication is just the next step in blocking spam.

How are you going to stop a spammer even with spf when he creates many
throwaway domains and list a huge part or all of the internet space as valid
sender ip for this domain.

----- Original Message ----- 
From: "Roger Moser" <roger_moser_spf(_at_)greenmail(_dot_)ch>
To: <spf-discuss(_at_)v2(_dot_)listbox(_dot_)com>
Sent: Monday, June 28, 2004 10:42 AM
Subject: [spf-discuss] Re: AOL's impatient servers


I haven't checked my logs, but I know plenty of qpsmtpd users find
this to be one of the single most successful spam/virus filters.

It's amazingly effective, especially if coupled with a longer delay for
hosts
that are on a spam blacklist.  I delay hosts that are on a few dynamic
IP
and
spam blacklists, or that have no reverse DNS, for 40 seconds before the
220
greeting.  Any RFC-compliant mailer will have no problem with this, but
a
lot
of spam software starts blissfully sending away before the delay is up.
Those
connections are sent a 5xx response and dropped.

Since most probably some spammers are members of this mailing list, I
would
not disclose here too many tips how to block spam.

Roger

-------
Sender Policy Framework: http://spf.pobox.com/
Archives at http://archives.listbox.com/spf-discuss/current/
Send us money!  http://spf.pobox.com/donations.html
To unsubscribe, change your address, or temporarily deactivate your
subscription,
please go to
http://v2.listbox.com/member/?listname=spf-discuss(_at_)v2(_dot_)listbox(_dot_)com