I've just found a new and interesting spam source - legitimate bounce messages

[Jeremy Chadwick]

On Thu, Oct 16, 2008 at 05:38:07PM +0100, RW wrote:
> On Thu, 16 Oct 2008 08:54:55 -0700 (PDT)
> Luke Dean <LukeD at pobox.com> wrote:
> 
> > 
> > 
> > On Thu, 16 Oct 2008, Matthew Seaman wrote:
> > 
> > > Until the wonderful day that the entire internet abides by these
> > > rules[*], use
> > > of technologies like SPF and DKIM can discourage but not entirely
> > > prevent the spammers from joe-jobbing you.
> > 
> > I just started getting these bouncebacks en masse this week.
> > My mail provider publishes SPF records.
> 
> SPF increases the probability of spam being rejected at the smtp
> level at MX servers, so my expectation would be that it would exacerbate
> backscatter not improve it. 

Just a side comment for added clarity: this ultimately depends on how
the mail server administrator implemented SPF.  For example, our mail
servers *do not* do SPF lookups at the SMTP level (e.g. in postfix)
because 1) the added complexity is not worth it, and 2) spammers are
now hijacking DNS.

Instead, our servers use SPF in SpamAssassin, subtracting from
the spam probability score if an SPF record is found and matches
appropriately.

-- 
| Jeremy Chadwick                                jdc at parodius.com |
| Parodius Networking                       http://www.parodius.com/ |
| UNIX Systems Administrator                  Mountain View, CA, USA |
| Making life hard for others since 1977.              PGP: 4BD6C0CB |