Trusting TLS for spamfighting purposes?

[Kelly Jones <ke...@gmail.com>]

Can SpamAssassin negative score emails that are sent using TLS?

I realize anyone (even spammers) can use TLS, but I tend to trust
encrypting mail servers more than I do non-encrypting ones.

However, I'm guessing all evidence of TLS usage has disappeared by the
time SpamAssassin gets the message?

-- 
We're just a Bunch Of Regular Guys, a collective group that's trying
to understand and assimilate technology. We feel that resistance to
new ideas and technology is unwise and ultimately futile.

Re: Trusting TLS for spamfighting purposes?

[Andrzej Adam Filip <an...@onet.eu>]

"Kelly Jones" <ke...@gmail.com> wrote:

> Can SpamAssassin negative score emails that are sent using TLS?
>
> I realize anyone (even spammers) can use TLS, but I tend to trust
> encrypting mail servers more than I do non-encrypting ones.
>
> However, I'm guessing all evidence of TLS usage has disappeared by the
> time SpamAssassin gets the message?

1) It may be present in topmost "Received:" header.
2) You may consider deploying SA via milter in SMTP session.
   * Milters are supported by sendmail and postfix
   * You may try tweaking MIMEDefang.org milter

-- 
[pl>en: Andrew] Andrzej Adam Filip : anfi@onet.eu : anfi@xl.wp.pl
You're always thinking you're gonna be the one that makes 'em act different.
  -- Woody Allen, "Manhattan"

Re: Trusting TLS for spamfighting purposes?

[Michael Scheidell <sc...@secnap.net>]

> Can SpamAssassin negative score emails that are sent using TLS?
> 
> I realize anyone (even spammers) can use TLS, but I tend to trust
> encrypting mail servers more than I do non-encrypting ones.
> 
> However, I'm guessing all evidence of TLS usage has disappeared by the
> time SpamAssassin gets the message?

I looked at this a while back.. Lots of spam with TLS from servers.
(too easy to set up in linux/ms)

As to how to check fingerprints:

Depends on your MTA.

Postfix, add this to main.cf:
smtpd_tls_received_header = yes
See this in emails:
Received: from fl.us.spammertrap.net (fl.us.spammertrap.net
[204.89.241.173])
    (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
    (No client certificate requested)
    by mail.secnap.net (Postfix) with ESMTPS id 34B33164838
    for <sc...@secnap.net>; Sat,  4 Oct 2008 10:29:49 -04

Regardless, I don't see any relationship between TLS and !spam.
In fact, most 'spam' that got through today had tls 'fingerprints' from our
MTA.

Only thing TLS MIGHT help with is zombies (I doubt that the infected bot on
the xp workstation would use TLS encryption).  So, using it with p0f, MAYBE,
as in:
If you think p0f or other 'dialup' things this is a workstation, and it has
TLS fingerprints, maybe not trigger the p0f / dialup/dynamic rules.


-- 
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer


_________________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r). 
For Information please see http://www.spammertrap.com
_________________________________________________________________________