You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Steve <sp...@shic.co.uk> on 2005/09/25 01:35:41 UTC
Joe-jobbed...What are my options?
I've recently had my domain targeted by a variety of offensive spammers
pushing legally dubious stuff who have chosen my domain as the sent-from
and/or reply to address in forged email.
My simple question (which I admit is a bit spamassassin off-topic) is
"what can I do about it?"
Sorry if this is really simple... any advice would be useful.
Thanks,
Steve
Re: Joe-jobbed...What are my options?
Posted by Michael Monnerie <m....@zmi.at>.
On Sonntag, 25. September 2005 01:35 Steve wrote:
> Sorry if this is really simple... any advice would be useful.
Not a lot, but SPF helps for that scenario. See http://spf.pobox.com
mfg zmi
--
// Michael Monnerie, Ing.BSc --- it-management Michael Monnerie
// http://zmi.at Tel: 0660/4156531 Linux 2.6.11
// PGP Key: "lynx -source http://zmi.at/zmi2.asc | gpg --import"
// Fingerprint: EB93 ED8A 1DCD BB6C F952 F7F4 3911 B933 7054 5879
// Keyserver: www.keyserver.net Key-ID: 0x70545879
Re: Joe-jobbed...What are my options?
Posted by Matt Kettler <mk...@evi-inc.com>.
Steve wrote:
> I've recently had my domain targeted by a variety of offensive spammers
> pushing legally dubious stuff who have chosen my domain as the sent-from
> and/or reply to address in forged email.
>
> My simple question (which I admit is a bit spamassassin off-topic) is
> "what can I do about it?"
There isn't much you can do, but one thing you can do is publish a SPF record
for your domain in your DNS records.
While this doesn't do much to stop spam, it does at least make it possible for
site receiving this spam to verify that it is a forgery.
This really is a small step, and won't solve your problems (SPF is not a
cure-all for spam), but does change a few things to make your life easier.
1) Fewer complaints:
Those sites which actually do check and verify SPF records will know not to
complain to you about it.
2) Fewer sources of bounces:
Many sites using SPF milters will reject this message prior to being queued so
you'll get fewer sources of bounces. You'll likely still get just as many
bounces, but more of them will come from the abused relay, and fewer will come
from other servers, making it easier for you to deal with them (by blocking the
abused relay with a 550).
3) Reduced incentive to repeat the joe-job:
SPF will also make it less useful for the spammer to continue to joe-job you.
Those messages will be detected as forgeries by sites that do check SPF records,
meaning the spams won't be reaching all of their "target audience".
Re: Joe-jobbed...What are my options?
Posted by Robert Menschel <Ro...@Menschel.net>.
Hello Steve,
Saturday, September 24, 2005, 4:35:41 PM, you wrote:
S> I've recently had my domain targeted by a variety of offensive spammers
S> pushing legally dubious stuff who have chosen my domain as the sent-from
S> and/or reply to address in forged email.
S> My simple question (which I admit is a bit spamassassin off-topic) is
S> "what can I do about it?"
Nothing you can do about the joe-job. Fortunatley, almost all admins
are smart enough these days to ignore the forged from address.
Unfortunately, many anti-spam systems aren't, and will bounce messages
back to you.
Use Tim Jackson's bogus bounce rule set to score those as spam.
Bob Menschel
Re: Joe-jobbed...What are my options?
Posted by Martin Schröder <ma...@oneiros.de>.
On 2005-09-24 20:08:03 -0400, Greg Allen wrote:
> is that these are email address harvest attacks. And, another theory is that
> spammers just don't care, the make email addresses up and sell them to other
> spammers.
Some also have broken address harvesters: I continually get spam
for my domain, where the mailbox is either a msgid or even only
part of a msgid of mails in a public mailing list archive. :-(
Best
Martin
--
http://www.tm.oneiros.de
RE: Joe-jobbed...What are my options?
Posted by Greg Allen <sa...@floridacpu.com>.
If I understand your question correctly, the industry seems to be going this
way...
Postfix has this beautiful rule.
------------------
reject_unverified_recipient
Reject the request when mail to the RCPT TO address is known to bounce, or
when the recipient address destination is not reachable. Address
verification information is managed by the verify(8) server; see the
ADDRESS_VERIFICATION_README file for details.
The unverified_recipient_reject_code parameter specifies the response when
an address is known to bounce (default: 450, change into 550 when you are
confident that it is safe to do so). Postfix replies with 450 when an
address probe failed due to a temporary problem. This feature is available
in Postfix 2.1 and later.
------------------
The nice thing about rejecting unverified recipients is that you will cut a
substantial amount of traffic on your email servers instantly, 75% to 90%
would not be an unreasonable reduction in unwanted traffic.
If you have servers downstream of your Postfix, they must support recipient
verification as well. For instance, Exchange 2000 does not, but Exchange
2003 does.
Where do all those bad email addresses come from? I have heard a couple
theories. One is that spammers are sending spam to your domain, when it
bounces it gets sent to the correct recipient by your email server (if your
server does not do recipient validation as described above). Another theory
is that these are email address harvest attacks. And, another theory is that
spammers just don't care, the make email addresses up and sell them to other
spammers.
Regardless, rejecting unverified recipients will most likely be a new
standard going forward, especially since Microsoft added the feature to
Exchange 2003 which makes it a default standard for office email systems.
> -----Original Message-----
> From: Steve [mailto:spamassassin_steve@shic.co.uk]
> Sent: Saturday, September 24, 2005 7:36 PM
> To: users@spamassassin.apache.org
> Subject: Joe-jobbed...What are my options?
>
>
> I've recently had my domain targeted by a variety of offensive spammers
> pushing legally dubious stuff who have chosen my domain as the sent-from
> and/or reply to address in forged email.
>
> My simple question (which I admit is a bit spamassassin off-topic) is
> "what can I do about it?"
>
> Sorry if this is really simple... any advice would be useful.
>
> Thanks,
>
> Steve
>
>