You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by da...@chaosreigns.com on 2011/05/11 22:01:38 UTC
Yahoo sent 5.5x as much spam as any other legit provider in April
http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
Percentage of total spam from legitimate email providers in April as
reported as abuse to dnswl.org:
35.5% yahoo.com
6.4% google.com
2.9% tp.pl
2.3% tin.it
1.8% messagelabs.com
1.4% hotmail.com
1.1% postini.com
1.0% orange.fr
1.0% aol.com
0.8% aruba.it
0.8% freenet.de
0.6% rediris.es
0.3% onet.pl
0.3% facebook.com
0.3% earthlink.net
0.0% kpnxchange.com
0.0% eircom.net
0.0% sfr.fr
0.0% web.de
--
"Let's just say that if complete and utter chaos was lightning, then
he'd be the sort to stand on a hilltop in a thunderstorm wearing wet
copper armour and shouting 'All gods are bastards'." - The Color of Magic
http://www.ChaosReigns.com
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Rick Macdougall <ri...@ummm-beer.com>.
On 11/05/2011 4:01 PM, darxus@chaosreigns.com wrote:
> http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
>
> Percentage of total spam from legitimate email providers in April as
> reported as abuse to dnswl.org:
>
> 35.5% yahoo.com
> 6.4% google.com
> 2.9% tp.pl
> 2.3% tin.it
> 1.8% messagelabs.com
> 1.4% hotmail.com
Interesting. Here, it's hotmail servers sending over 57% of the spam.
I wonder if they are so low on that list because the list the actual
senders IP as the origination point.
Regards,
Rick
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Joe Sniderman <jo...@thoroquel.org>.
On 05/11/2011 04:19 PM, darxus@chaosreigns.com wrote:
> I bet it's largely related to the fact that yahoo is apparently the only
> freemail provider that doesn't require you to have a previously existing
> email address.
Yahoo does not require an existing address.
Hotmail/MSN/Live does not require an existing address.
AOL/AIM does not require an existing address.
Gmail does not require an existing address. [1][2]
Mail.com does not require an existing address.
...
It seems GMX.com *does* require an existing address. This appears to be
the exception rather than the rule.
> I also suspect that, for this reason, google.com would send less spam
> if they didn't allow yahoo addresses as the pre-existing address.
*If* Gmail were to require an existing address, prohibiting Yahoo
addresses *might* make sense.
[1] This seems to depend on the IP address used to sign up for the
google account. When signing up through a TOR exit node (at least at the
time that I tried it, which was > 1yr ago) Gmail asked for either a
cellphone number for text confirmation, or an existing email address.
Yahoo did not differentiate between TOR exit nodes and non-TOR IPs.
[2] Google apps accounts however do seem to require a preexisting email
address, however gmail addresses are accepted for that purpose.
--
Joe Sniderman <jo...@thoroquel.org>
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Adam Katz <an...@khopis.com>.
On 05/11/2011 01:19 PM, darxus@chaosreigns.com wrote:
> I bet it's largely related to the fact that yahoo is apparently the
> only freemail provider that doesn't require you to have a previously
> existing email address.
I just created a test @live.com (hotmail) account without an
existing address. Just tell it to use a security question instead. I
am under the impression that gmail is the only one that has that sort of
protection, and even it is trivially defeated (look up mailinator for
one method).
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by da...@chaosreigns.com.
I bet it's largely related to the fact that yahoo is apparently the only
freemail provider that doesn't require you to have a previously existing
email address.
I also suspect that, for this reason, google.com would send less spam
if they didn't allow yahoo addresses as the pre-existing address.
--
"I would believe only in a God that knows how to Dance." - Nietzsche
http://www.ChaosReigns.com
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello darxus@chaosreigns.com,
Am 2011-05-11 16:01:38, hacktest Du folgendes herunter:
> http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
>
> Percentage of total spam from legitimate email providers in April as
> reported as abuse to dnswl.org:
>
> 35.5% yahoo.com
Configuration option in /etc/courier/bofh would be:
badfrom @yahoo.com
and the problem is regulated on SMTP level without involving SA.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +49-176-86004575 office
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Adam Katz <an...@khopis.com>.
On 05/11/2011 01:01 PM, darxus@chaosreigns.com wrote:
> http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
Too bad FF doesn't let me zoom on an svg; had to hit F11 to see it.
> Percentage of total spam from legitimate email providers in April as
> reported as abuse to dnswl.org:
>
> 35.5% yahoo.com
> 6.4% google.com
> 2.9% tp.pl
> 2.3% tin.it
> 1.8% messagelabs.com
> 1.4% hotmail.com
> 1.1% postini.com
> 1.0% orange.fr
> 1.0% aol.com
...
Long tail there; the sum of all of your items was 56.5%. Even if you
truncated those numbers, it doesn't add up (56.5 + 19 * 0.1% = 58.4%).
I'm not sure how much of my company's data I can disperse, but here's a
peek. We break things down a little differently, but here is what
overlaps (as isolated by From header in trap + report data, classified
spam only):
100.0% (sum of all items below)
32.6% yahoo
29.4% hotmail + live
17.3% gmail
10.8% aol
9.8% facebook
0.1% orange.fr
So with this data, yahoo sent 1.1x as much as hotmail.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Wed, 11 May 2011 16:51:58 -0400
Michael Scheidell <mi...@secnap.com> wrote:
> ie: qmail, postfix, exchange, sendmail, all (can) send a 4xx after
> rcpt to.
Indeed.
> because thats what the RFC's say.
Note: I said "badly-written SMTP software", not "software that adheres
to the RFCs".
In the real world, 4xx after RCPT breaks a non-zero number of SMTP clients.
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Michael Scheidell <mi...@secnap.com>.
On 5/11/11 4:49 PM, David F. Skoll wrote:
> Ah, ok. We avoid issuing 4xx in response to a "RCPT" command because
> quite a lot of badly-written SMTP software doesn't handle that well.
>
ie: qmail, postfix, exchange, sendmail, all (can) send a 4xx after rcpt to.
because thats what the RFC's say.
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Wed, 11 May 2011 16:35:50 -0400
Michael Scheidell <mi...@secnap.com> wrote:
> if someone sends an email to 175 people, once they hit 'x' number in
> the first email attempt, we send '4xx too many emails'
Ah, ok. We avoid issuing 4xx in response to a "RCPT" command because
quite a lot of badly-written SMTP software doesn't handle that well.
We 4xx after DATA when greylisting which doesn't seem to give as much
trouble.
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Thu, 12 May 2011 16:00:38 +0200
Michelle Konzack <li...@tamay-dogan.net> wrote:
> Which RFC? Limiting the "recipients per envelope" is legitim.
Limiting it to 1 is pushing it. RFC 5321 says:
"The minimum total number of recipients that MUST be buffered is 100
recipients. Rejection of messages (for excessive recipients) with
fewer than 100 RCPT commands is a violation of this specification."
Additionally, limiting it to 1 will have very undesirable side-effects.
Mailman, for example, sends messages out in chunks of 30 recipients
at a time by default. If all 30 recipients are on a server that only
accepts one at a time and your mail server retries every 10 minutes, the
last recipient will receive the message 5 hours after the first recipient.
That's pretty unfriendly behaviour.
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> > Nobody requires you to execute 100 spamassassin processes and nobody
> > requires to run them them in parallel. However, the RFCs DOES require you
> > accepting at least 100 recipients at once.
On 16.05.11 23:19, Michelle Konzack wrote:
> It happen automaticaly if...
> ...the system accept 100 messages at once for 100 different recipients.
> Sending to 100 recipients is like a DoS.
sending one mail to 100 recipients is OK, receiving 100 mails in parallel
can be delayed by other ways (e.g. limiting maximum number of connections).
> > You can run spamassassin with safe global preferences for mail destined to
> > more recipients. Or, you can run different domains on different IPs with
> > different SA configurations. That could spare you from multiple checking
> > mail to multiple recipients.
>
> I have already over 20 mailservers with more then 98.000 users and
> currently I am installing 30 new mailservers (each with 2500 users)...
>
> And yes, 72.000 users are from the same company, but if they have to
> send a message to the WHOLE enterprise, they use my own service which
> bypass the standard mail deliver over the MTAs.
>
> I can push the 72.000 messages in less then 3 minutes into the mailboxes
This has nothing to do with my recommendation. You can safely scan all mail
to multiple (no matter if 10 or 100) recipients with unpersonalized SA, then
re-scan each again to get personalized results.
I guess you don't drop all mail tagged as spam and suspicious e-mail is
still delivered to their spamboxes.
> > RFC, do not expect SMTP clients to behave as you want. If anyone will have
> > problems caused by you rejecting 11th recipient, it will be YOUR problem.
> By droping spam?
no, by dropping 11th to 100th recipient.
> > Don't blame me. You could blame the RFC but I believe its authors knew more
> > than you do.
>
> The RFC-Requirement is a big bullshit!
It is not. It is there for preventing postmasters from doing things the
easy, but wrong way, e.g. like you do.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I intend to live forever - so far so good.
Re: 100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as any other legit provider in April)
Posted by Per Jessen <pe...@computer.org>.
Mark Martinec wrote:
> Per,
>
>> Splitting hairs...
>
> No problem.
>
>> queueing is an implementation of a design, and almost
>> certainly what amavisd does :-)
>
> Surprise ... it doesn't. Queueing is left entirely in hands of an
> MTA, and if using a pre-queue setup such as a smtp proxy as offered by
> Postfix (or a milter setup) there is no additional queuing besides
> what an MTA already does.
>
> Most importantly: a message is not processed one recipient at at time,
> but as one entity, with one call to SpamAssassin, and then carefully
> adjusting final message editing if settings of mail's recipients
> require different final touches. It practically makes not difference
> in timing if a message has one or a thousand recipients.
Interesting, thanks for enlightening me. I guess amavisd is just being
opportunistic about it and hoping not many recipients will have
individual settings?
/Per Jessen, Zürich
Re: 100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as any other legit provider in April)
Posted by Mark Martinec <Ma...@ijs.si>.
Per,
> Splitting hairs...
No problem.
> queueing is an implementation of a design, and almost
> certainly what amavisd does :-)
Surprise ... it doesn't. Queueing is left entirely in hands of an MTA,
and if using a pre-queue setup such as a smtp proxy as offered by Postfix
(or a milter setup) there is no additional queuing besides what an MTA
already does.
Most importantly: a message is not processed one recipient at at time,
but as one entity, with one call to SpamAssassin, and then carefully
adjusting final message editing if settings of mail's recipients require
different final touches. It practically makes not difference in timing
if a message has one or a thousand recipients.
Mark
Re: 100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as any other legit provider in April)
Posted by Per Jessen <pe...@computer.org>.
Mark Martinec wrote:
> David F. Skoll wrote:
>> That's a bad design. Our system can accept mail to multiple
>> recipients with individual filtering and without running many
>> SpamAssassin processes in parallel. It can be done.
>
> Indeed.
>
>
> Per Jessen wrote:
>> Sure, it's only a question of queueing.
>
>
> I'd join David and say it's a matter of design.
Splitting hairs - queueing is an implementation of a design, and almost
certainly what amavisd does :-)
/Per Jessen, Zürich
Re: 100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as any other legit provider in April)
Posted by Mark Martinec <Ma...@ijs.si>.
David F. Skoll wrote:
> That's a bad design. Our system can accept mail to multiple
> recipients with individual filtering and without running many
> SpamAssassin processes in parallel. It can be done.
Indeed.
Per Jessen wrote:
> Sure, it's only a question of queueing.
I'd join David and say it's a matter of design.
Amavisd can do it too: handle multi-recipient messages
efficiently, calling SpamAssassin only once per message
(not once per recipient), yet still faithfully implementing
per-recipient settings like score thresholds, black/whitelisting,
bypassing certain checks, tagging (Subject, addr. extensions),
defanging, ...
Mark
Re: 100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as any other legit provider in April)
Posted by Per Jessen <pe...@computer.org>.
David F. Skoll wrote:
> On Mon, 16 May 2011 23:19:26 +0200
> Michelle Konzack <li...@tamay-dogan.net> wrote:
>
>
>> > Nobody requires you to execute 100 spamassassin processes and
>> > nobody
>> It happen automaticaly if...
>> ...the system accept 100 messages at once for 100 different
>> recipients. Sending to 100 recipients is like a DoS.
>
> That's a bad design. Our system can accept mail to multiple
> recipients with individual filtering and without running many
> SpamAssassin processes in parallel. It can be done.
Sure, it's only a question of queueing.
/Per Jessen, Zürich
100 RCPTs in one session (was Re: Yahoo sent 5.5x as much spam as
any other legit provider in April)
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Mon, 16 May 2011 23:19:26 +0200
Michelle Konzack <li...@tamay-dogan.net> wrote:
> > Nobody requires you to execute 100 spamassassin processes and nobody
> It happen automaticaly if...
> ...the system accept 100 messages at once for 100 different
> recipients. Sending to 100 recipients is like a DoS.
That's a bad design. Our system can accept mail to multiple recipients
with individual filtering and without running many SpamAssassin processes in
parallel. It can be done.
[...]
> The RFC-Requirement is a big bullshit!
Careful. Some RFC requirements indeed do not make sense, but you
should not violate a MUST requirement without a lot of justification
(certainly better justification than you've given.)
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Matus UHLAR - fantomas,
Am 2011-05-16 10:51:26, hacktest Du folgendes herunter:
> Nobody requires you to execute 100 spamassassin processes and nobody
It happen automaticaly if...
> requires to run them them in parallel. However, the RFCs DOES require you
> accepting at least 100 recipients at once.
...the system accept 100 messages at once for 100 different recipients.
Sending to 100 recipients is like a DoS.
> You can run spamassassin with safe global preferences for mail destined to
> more recipients. Or, you can run different domains on different IPs with
> different SA configurations. That could spare you from multiple checking
> mail to multiple recipients.
I have already over 20 mailservers with more then 98.000 users and
currently I am installing 30 new mailservers (each with 2500 users)...
And yes, 72.000 users are from the same company, but if they have to
send a message to the WHOLE enterprise, they use my own service which
bypass the standard mail deliver over the MTAs.
I can push the 72.000 messages in less then 3 minutes into the mailboxes
> Then you are violating the RFC. As I have already stated, where you violate
> RFC, do not expect SMTP clients to behave as you want. If anyone will have
> problems caused by you rejecting 11th recipient, it will be YOUR problem.
By droping spam? If ONE of myusers send bulkmails, he/she know, she can
not have more then 10 recipients. If someone send from outside I will
give a fsck on it.
> Don't blame me. You could blame the RFC but I believe its authors knew more
> than you do.
The RFC-Requirement is a big bullshit!
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +49-176-86004575 office
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 15.05.11 18:50, Michelle Konzack wrote:
> Am 2011-05-15 18:08:36, hacktest Du folgendes herunter:
>
> You are late!
>
> > so far, every RFC defining SMTP yet released. They all (821, 2821, 5321) say
> > at least 100 must be accepted.
>
> ...and what if your Mailserver can not handel the threatment of 100
> recipients parallel, because spamfiltering is done per user?
Then the mailserver violates RFC, because it MUST handle at least 100 of
them. See RFC 5321, section 4.5.3.1.8.
> Here on my system it would start 100 spamassassin processes which will
> kill the machine!
Nobody requires you to execute 100 spamassassin processes and nobody
requires to run them them in parallel. However, the RFCs DOES require you
accepting at least 100 recipients at once.
> And of course, sending to 100 and more recipients at once, is 100% spam
> on my system!
You can run spamassassin with safe global preferences for mail destined to
more recipients. Or, you can run different domains on different IPs with
different SA configurations. That could spare you from multiple checking
mail to multiple recipients.
> I have set the limit to 10 and even this is already spam which I see
> from the mail log.
Then you are violating the RFC. As I have already stated, where you violate
RFC, do not expect SMTP clients to behave as you want. If anyone will have
problems caused by you rejecting 11th recipient, it will be YOUR problem.
Don't blame me. You could blame the RFC but I believe its authors knew more
than you do.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Atheism is a non-prophet organization.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Matus UHLAR - fantomas,
Am 2011-05-15 18:08:36, hacktest Du folgendes herunter:
You are late!
> so far, every RFC defining SMTP yet released. They all (821, 2821, 5321) say
> at least 100 must be accepted.
...and what if your Mailserver can not handel the threatment of 100
recipients parallel, because spamfiltering is done per user?
Here on my system it would start 100 spamassassin processes which will
kill the machine!
And of course, sending to 100 and more recipients at once, is 100% spam
on my system!
I have set the limit to 10 and even this is already spam which I see
from the mail log.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +49-176-86004575 office
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> > On 11.05.11 19:30, Joe Sniderman wrote:
> > > We do something similar, except that the maximum number of recipients
> > > per envelope we set at 1. The second and all subsequent get a 4yz error
> > > during RCPT. We perform this after greylisting, ie:
> Am 2011-05-12 09:06:10, hacktest Du folgendes herunter:
> > Are you aware that this violates RFC standard?
On 12.05.11 16:00, Michelle Konzack wrote:
> Which RFC? Limiting the "recipients per envelope" is legitim.
so far, every RFC defining SMTP yet released. They all (821, 2821, 5321) say
at least 100 must be accepted.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
99 percent of lawyers give the rest a bad name.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Michelle Konzack <li...@tamay-dogan.net>.
Hello Matus UHLAR - fantomas,
Am 2011-05-12 09:06:10, hacktest Du folgendes herunter:
> On 11.05.11 19:30, Joe Sniderman wrote:
> > We do something similar, except that the maximum number of recipients
> > per envelope we set at 1. The second and all subsequent get a 4yz error
> > during RCPT. We perform this after greylisting, ie:
>
> Are you aware that this violates RFC standard?
Which RFC? Limiting the "recipients per envelope" is legitim.
> You can not expect that when you violate it, others will behave at your
> needs. For example, I would imediately try other MX server when sending
> mail and not continue with DATA.
I get per day arround 26.000.000 spams on my courier-proxys and if I do
not limit the number "recipients per envelope" I would receive per
second 300 spams.
Note: 80% of the spams are rejected on SMTP Level without invoking SA.
Thanks, Greetings and nice Day/Evening
Michelle Konzack
--
##################### Debian GNU/Linux Consultant ######################
Development of Intranet and Embedded Systems with Debian GNU/Linux
itsystems@tdnet France EURL itsystems@tdnet UG (limited liability)
Owner Michelle Konzack Owner Michelle Konzack
Apt. 917 (homeoffice)
50, rue de Soultz Kinzigstraße 17
67100 Strasbourg/France 77694 Kehl/Germany
Tel: +33-6-61925193 mobil Tel: +49-177-9351947 mobil
Tel: +49-176-86004575 office
<http://www.itsystems.tamay-dogan.net/> <http://www.flexray4linux.org/>
<http://www.debian.tamay-dogan.net/> <http://www.can4linux.org/>
Jabber linux4michelle@jabber.ccc.de
ICQ #328449886
Linux-User #280138 with the Linux Counter, http://counter.li.org/
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> On 05/11/2011 04:35 PM, Michael Scheidell wrote:
> > if someone sends an email to 175 people, once they hit 'x' number in the
> > first email attempt, we send '4xx too many emails'
>
> > ie:
> > ehlo *.yahoo.com
> > mail from: <so...@yahoo.com>
> > rcpt to: <one>
> > 250 ok
> > rcpt to: <two>
> > 250 ok
> > [skip to 100].
> > rcpt to: <onehundered>
> > 4xx too many
On 11.05.11 19:30, Joe Sniderman wrote:
> We do something similar, except that the maximum number of recipients
> per envelope we set at 1. The second and all subsequent get a 4yz error
> during RCPT. We perform this after greylisting, ie:
Are you aware that this violates RFC standard?
You can not expect that when you violate it, others will behave at your
needs. For example, I would imediately try other MX server when sending
mail and not continue with DATA.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
Save the whales. Collect the whole set.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Joe Sniderman <jo...@thoroquel.org>.
On 05/11/2011 04:35 PM, Michael Scheidell wrote:
> if someone sends an email to 175 people, once they hit 'x' number in the
> first email attempt, we send '4xx too many emails'
> ie:
> ehlo *.yahoo.com
> mail from: <so...@yahoo.com>
> rcpt to: <one>
> 250 ok
> rcpt to: <two>
> 250 ok
> [skip to 100].
> rcpt to: <onehundered>
> 4xx too many
We do something similar, except that the maximum number of recipients
per envelope we set at 1. The second and all subsequent get a 4yz error
during RCPT. We perform this after greylisting, ie:
...
RCPT TO:<fistrecip>
451 4.7.1 Greylisting in action
RCPT TO:<secondrecip>
451 4.7.1 Greylisting in action
..some time later...
RCPT TO:<firstrecip>
250 ok
RCPT TO:<secondrecip>
451 4.7.1 One at a time please
DATA
..after another retry..
RCPT TO:<secondrecip>
250 ok
DATA
Rationale being that content filtering during DATA can be customized on
a per recipient basis, without having to generate bounces after the fact
nor resorting to dropping emails silently.
> RFC'S seem to indicate that they should send a data command next and
> send the email to be delivered to the first 99, then try the next 51 on
> the next highest mx.
Or in our case, the first one, and retry for the next 149, get one more
out, retry for the next 148, and so on. We do greylist, and Yahoo gets
a rather long default greylisting and very short AWL.
> doesn't happen on yahoo.com
> they drop the connection, and try again at next highest mx, then on mx4,
> bounce the email back to sender with the last mx's ip in the error
> message and the 4xx too many
Interesting. My experience has been that Yahoo does retry at the same MX
but will not go to the next MX in response to 4yx errors. (OTOH if the
connection times out they do go on the next MX)
--
Joe Sniderman <jo...@thoroquel.org>
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Michael Scheidell <mi...@secnap.com>.
On 5/11/11 4:14 PM, David F. Skoll wrote:
> Do you have evidence to back up that claim? I don't believe
> it's true. We use greylisting and Yahoo's servers don't seem
> to have problems with it.
what I have observed; (no, we don't greylist)
but, we do keep a cluster of 4 mx servers per client. each one with
different bl, timing, available smtp connections, etc.
if someone sends an email to 175 people, once they hit 'x' number in the
first email attempt, we send '4xx too many emails'
ie:
ehlo *.yahoo.com
mail from: <so...@yahoo.com>
rcpt to: <one>
250 ok
rcpt to: <two>
250 ok
[skip to 100].
rcpt to: <onehundered>
4xx too many
RFC'S seem to indicate that they should send a data command next and
send the email to be delivered to the first 99, then try the next 51 on
the next highest mx.
doesn't happen on yahoo.com
they drop the connection, and try again at next highest mx, then on mx4,
bounce the email back to sender with the last mx's ip in the error
message and the 4xx too many
aol does something similar also, but will send the first 'x' number of
emails, and MAYBE later send the rest.
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Wed, 11 May 2011 14:21:23 -0700
Ted Mittelstaedt <te...@ipinc.net> wrote:
> We have been using greylist-milter for years and all Yahoo's
> IP ranges are listed in the exception list, even the ones that they
> don't publish and you can only find by issuing a whois against the
> RIR database.
We've been using our greylisting implementation for years and
have had no problems. We don't even implement an "exception list"
because none has been needed.
As I wrote before, I think it's because we tempfail after DATA rather
than RCPT.
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Matus,
Monday, May 16, 2011, 3:28:04 PM, you wrote:
MUf> I think we agree that Yahoo has problems with 4xx although
MUf> not in all cases.
Mind a worse sin is using the same outbound servers for group emails
as they let all their spammers use.
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Matus,
Monday, May 16, 2011, 3:28:04 PM, you wrote:
MUf> well, are you an yahoo employee?
ROFL
A bit of playing with whois might reveal a bit :)
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
> Sunday, May 15, 2011, 5:49:39 PM, you wrote:
>
> MUf> The original claim was done Ted Mittelstaedt.
On 15.05.11 18:34, Niamh Holding wrote:
> Indeed, and it is that blanket claim I an refuting.
too late then. I think we agree that Yahoo has problems with 4xx although
not in all cases. And I think it was narrowed before your complaint.
well, are you an yahoo employee?
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The early bird may get the worm, but the second mouse gets the cheese.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Matus,
Sunday, May 15, 2011, 5:49:39 PM, you wrote:
MUf> The original claim was done Ted Mittelstaedt.
Indeed, and it is that blanket claim I an refuting.
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 12.05.11 12:49, Niamh Holding wrote:
> Hello Matus,
>
> Thursday, May 12, 2011, 12:11:10 PM, you wrote:
>
> MUf> Actyally, Michael Scheidell reported that yahoo miebehaves when receiving
> MUf> 4xx response after RCPT TO:
>
> Very different from the original blanket claim that "Yahoo's SMTP mailers are
> unable to handle a standard SMTP error 4xx, if they get one they abort
> the transmission and return the message to the sender"
The original claim was done Ted Mittelstaedt. Michael Scheidell narrowed it
to broken reaction to 4xx after RCPT command.
I just added that the 4xx after RCPT may have different reason than
recipient limit crossed and (indirectly) asked Ted if he can confirm his
greylist returns 4xx after RCPT stage.
Just for curiousity I'll search our logs for similar problems with yahoo.
Imho, running greylist after data stage has some advantages, however Yahoo
should be ok even with 4xx after RCPT.
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
I feel like I'm diagonally parked in a parallel universe.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Ted,
Thursday, May 12, 2011, 5:06:15 PM, you wrote:
TM> I mentioned that this was with greylist-milter, you are merely
TM> shifting your claim now to essentially blaming greylist-milter for
TM> not issuing a standard SMTP error 4xx.
No you didn't, and no I am not casting any aspersions on any other
software at all... unless you can find a message from me blaming
greylist-milter-
"Yahoo's SMTP mailers are unable to handle a standard SMTP error 4xx,
if they get one they abort the transmission and return the message to
the sender"
No qualification at all in your original claim.
I have merely provided evidence that yahoo's servers do not always "abort the
transmission and return the message to the sender" as you claimed
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Giles Coochey <gi...@coochey.net>.
On Fri, May 13, 2011 17:09, Ted Mittelstaedt wrote:
> On 5/13/2011 1:58 AM, Giles Coochey wrote:
>> Not quite - Google's retry may come from another server in a different
>> range.
>
> if it did then mail from Google would be delayed significantly, like
> 12-24 hours for example.
>
Yes, exactly, this is the behaviour I experienced, I installed
greylist-milter and wathced it operate for over a week, literally
constantly operating a tail on my maillog. It was very effective at
stopping spam, but various domains had various delays which were not
tolerable.
>> .. and because the ranges can change (over time) I tend to stay away
>> from Greylisting, despite its effectiveness I am paranoid about false
>> positives.
>>
>
> I will say flatly you don't understand how greylist-milter operates
> to make such a statement. I'm not going to post 4 paragraphs about
> it here, you can look up how it works elsewhere. But just be aware
> your statement is nonsensical, like answering "I never liked the
> taste of blackberries" when someone says "the sky is a pretty blue today"
>
As I previously mentioned, I installed it and watched it operate for over
a week. If you have the time to manually maintain exclusions for the
peculiarities of various types of MTA and various ISPs then go ahead...
For me I don't want to worry about whether mail I temporarily reject not
ever reaching its destination.
And I've got better things to do than spend time working out what is not
getting through and coming up with innovative ways for fine-tuning the
software.
This is not intended as a slag-off of greylisting, simply a statement that
it requires constant maintenance if you are going to be sure that all
legitimate mail is reaching its destination.
In my environment I cannot tolerate losing a legitimate message.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 5/13/2011 1:58 AM, Giles Coochey wrote:
> On Thu, May 12, 2011 18:06, Ted Mittelstaedt wrote:
>> On 5/12/2011 4:49 AM, Niamh Holding wrote:
>>>
>>> Hello Matus,
>>>
>>> Thursday, May 12, 2011, 12:11:10 PM, you wrote:
>>>
>>> MUf> Actyally, Michael Scheidell reported that yahoo miebehaves when
>>> receiving
>>> MUf> 4xx response after RCPT TO:
>>>
>>> Very different from the original blanket claim that "Yahoo's SMTP
>>> mailers are
>>> unable to handle a standard SMTP error 4xx, if they get one they abort
>>> the transmission and return the message to the sender"
>>>
>>
>> And yet Googles server farm has no problem with greylist-milter.
>>
> Not quite - Google's retry may come from another server in a different
> range.
if it did then mail from Google would be delayed significantly, like
12-24 hours for example.
> .. and because the ranges can change (over time) I tend to stay away
> from Greylisting, despite its effectiveness I am paranoid about false
> positives.
>
I will say flatly you don't understand how greylist-milter operates
to make such a statement. I'm not going to post 4 paragraphs about
it here, you can look up how it works elsewhere. But just be aware
your statement is nonsensical, like answering "I never liked the
taste of blackberries" when someone says "the sky is a pretty blue today"
Ted
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Giles Coochey <gi...@coochey.net>.
On Thu, May 12, 2011 18:06, Ted Mittelstaedt wrote:
> On 5/12/2011 4:49 AM, Niamh Holding wrote:
>>
>> Hello Matus,
>>
>> Thursday, May 12, 2011, 12:11:10 PM, you wrote:
>>
>> MUf> Actyally, Michael Scheidell reported that yahoo miebehaves when
>> receiving
>> MUf> 4xx response after RCPT TO:
>>
>> Very different from the original blanket claim that "Yahoo's SMTP
>> mailers are
>> unable to handle a standard SMTP error 4xx, if they get one they abort
>> the transmission and return the message to the sender"
>>
>
> And yet Googles server farm has no problem with greylist-milter.
>
Not quite - Google's retry may come from another server in a different
range... and because the ranges can change (over time) I tend to stay away
from Greylisting, despite its effectiveness I am paranoid about false
positives.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 5/12/2011 4:49 AM, Niamh Holding wrote:
>
> Hello Matus,
>
> Thursday, May 12, 2011, 12:11:10 PM, you wrote:
>
> MUf> Actyally, Michael Scheidell reported that yahoo miebehaves when receiving
> MUf> 4xx response after RCPT TO:
>
> Very different from the original blanket claim that "Yahoo's SMTP mailers are
> unable to handle a standard SMTP error 4xx, if they get one they abort
> the transmission and return the message to the sender"
>
And yet Googles server farm has no problem with greylist-milter.
I mentioned that this was with greylist-milter, you are
merely shifting your claim now to essentially blaming greylist-milter
for not issuing a standard SMTP error 4xx.
Yahoo is not the only mailserver that misbehaves with 4xx errors. As
a result I have always vastly overbuilt my mailservers so that there
is never a chance of them issuing a "real" 4xx error because they are
actually too busy to accept mail. I certainly cannot trust any
mailserver or mailserver farm on the Internet to handle a "real"
4xx error correctly, thanks to miscreants like Yahoo who apparently
think it's OK to mishandle some 4xx errors and not others, and
who have provided cover for the other boneheads to do the same thing.
Ted
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Matus,
Thursday, May 12, 2011, 12:11:10 PM, you wrote:
MUf> Actyally, Michael Scheidell reported that yahoo miebehaves when receiving
MUf> 4xx response after RCPT TO:
Very different from the original blanket claim that "Yahoo's SMTP mailers are
unable to handle a standard SMTP error 4xx, if they get one they abort
the transmission and return the message to the sender"
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
>> Thursday, May 12, 2011, 7:36:01 AM, you wrote:
>> TM> Your welcome to my exclusion list if you want it, I'm not
>> TM> going to post it here but anyone who wants a copy can just ask.
>> TM> Do you want a copy?
> On 5/12/2011 12:08 AM, Niamh Holding wrote:
>> Of your exclusion list no, but I am asking you to post the evidence
>> backing up your unsubstantiated claim to the list.
On 12.05.11 01:54, Ted Mittelstaedt wrote:
> Others have reported Yahoo doesn't handle 4xx errors properly,
> you apparently missed their posts?
Actyally, Michael Scheidell reported that yahoo miebehaves when receiving
4xx response after RCPT TO:, while David F. Skoll reported that yahoo
behaves correctly when receiving 4xx after DATA.
I assume your greylist sends 4xx after RCPT TO stage.
I may add that courier smtpd may send 4xx after RCPT either when
maxrecipients is crossed, or e.g. when user's mailbox is full.
However I haven't encountered this before, apparently noone sends us that
much mail from yahoo...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
On the other hand, you have different fingers.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Ted,
Thursday, May 12, 2011, 9:54:56 AM, you wrote:
TM> I investigated and did not see retries from
TM> Yahoo's mailservers in the mail log file
Funnily enough I do see retries-
2009-10-03 02:01:32.887 tcpserver: ok 24589 mail.redbus.holtain.net:217.146.107.39:25 n10.bullet.mail.mud.yahoo.com:209.191.125.208::48678
2009-10-03 02:01:32.892 jgreylist[24589]: 209.191.125.208: GREY first time
2009-10-03 02:03:25.201 tcpserver: ok 24631 mail.redbus.holtain.net:217.146.107.39:25 n10.bullet.mail.mud.yahoo.com:209.191.125.208::20564
2009-10-03 02:03:25.206 jgreylist[24631]: 209.191.125.208: GREY too soon
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 5/12/2011 12:08 AM, Niamh Holding wrote:
>
> Hello Ted,
>
> Thursday, May 12, 2011, 7:36:01 AM, you wrote:
>
> TM> Your welcome to my exclusion list if you want it, I'm not
> TM> going to post it here but anyone who wants a copy can just ask.
> TM> Do you want a copy?
>
> Of your exclusion list no, but I am asking you to post the evidence
> backing up your unsubstantiated claim to the list.
>
Others have reported Yahoo doesn't handle 4xx errors properly,
you apparently missed their posts?
If you are a Yahoo programmer and wish to work with me to
correct your servers then please e-mail me offline from your
actual Yahoo corporate account, provide an office extension
at Yahoo, a phone number, and I will call you to arrange to
setup a test mailserver with greylist-milter and you can
send test messages to it and we can log the results, and
get your problem solved.
But if you are not then all I'm going to say is that anyone
who understands e-mail can do the appropriate whois queries that
will establish what I am in charge of in less than 30 seconds,
and draw their own conclusions. I have had problems with users
not getting e-mail when Yahoo's IP addresses were not excluded
from greylisting, I investigated and did not see retries from
Yahoo's mailservers in the mail log file, I excluded Yahoo's IP ranges
from greylisting, the users reported the problems went away. I have not
had to exclude other mailservers on the Internet for greylisting
for this reason. I HAVE excluded some other services that
use server pools because not excluding them delays mail (as
their pool will try different servers until all servers have
been tried then start over and the transmission succeeds) but
no other services have simply failed to attempt to retry as
Yahoo does.
Therefore I have had it proved to my satisfaction that Yahoo's
mailservers do not retry when greylisted - which breaks
greylisting. Maybe they retry if the 4xx is issued to them
under other circumstances, but I don't care about that.
Obviously, anyone else running the same greylisting
as I am would have had the same experience as there is no reason
Yahoo would single me out from the thousands of other ISPs out
there that use greylist-milter. So they would have to also
exempt Yahoo from their own greylisting. I'm sure this is a
big factor in their spam source ranking.
Once I learned what I learned I moved on to other things and
I did not save all of the evidence just to be able to trot it out
on mailing lists years in the future.
Perhaps since I had that problem Yahoo has changed. But
I'm not going to risk having user trouble again by removing
them from the exemption list. Fool me once, shame on you,
fool me twice, shame on me.
Ted
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Ted,
Thursday, May 12, 2011, 7:36:01 AM, you wrote:
TM> Your welcome to my exclusion list if you want it, I'm not
TM> going to post it here but anyone who wants a copy can just ask.
TM> Do you want a copy?
Of your exclusion list no, but I am asking you to post the evidence
backing up your unsubstantiated claim to the list.
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 5/11/2011 10:58 PM, Niamh Holding wrote:
>
> Hello Ted,
>
> Wednesday, May 11, 2011, 10:21:23 PM, you wrote:
>
> TM> Yes, your Honor. (eyeroll)
>
> Any intention to produce it in support of your claim?
>
Your welcome to my exclusion list if you want it, I'm not
going to post it here but anyone who wants a copy can just ask.
Do you want a copy?
Ted
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Niamh Holding <ni...@fullbore.co.uk>.
Hello Ted,
Wednesday, May 11, 2011, 10:21:23 PM, you wrote:
TM> Yes, your Honor. (eyeroll)
Any intention to produce it in support of your claim?
--
Best regards,
Niamh mailto:niamh@fullbore.co.uk
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
On 5/11/2011 1:14 PM, David F. Skoll wrote:
> On Wed, 11 May 2011 13:10:31 -0700
> Ted Mittelstaedt<te...@ipinc.net> wrote:
>
>> Yahoo's SMTP mailers are unable to handle a standard
>> SMTP error 4xx, if they get one they abort the
>> transmission and return the message to the sender
>
> Do you have evidence to back up that claim?
Yes, your Honor. (eyeroll)
> I don't believe
> it's true. We use greylisting and Yahoo's servers don't seem
> to have problems with it.
>
We have been using greylist-milter for years and all Yahoo's
IP ranges are listed in the exception list, even the ones that they
don't publish and you can only find by issuing a whois against the RIR
database.
Those listings weren't there when we set it up. They got there
after user complaints and me wasting time tracking them down.
> It seems to me that Yahoo just isn't as good as Google or Hotmail
> at preventing spammers from signing up and at blocking outbound spam.
>
Yahoo is an example of a company that had such a bright promise coming
out of the 90's but internally screwed everything up, from bringing
in a CEO who was completely out of his league (Terry Semel) and
allowing the same guy who did that to run the company (jerry lang)
who screwed the Microsoft deal then got into bed with Microsoft a
year later anyway.
They may have managed to replace the top brass there but the corporate
culture is still NIH.
Ted
> Regards,
>
> David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in
April
Posted by "David F. Skoll" <df...@roaringpenguin.com>.
On Wed, 11 May 2011 13:10:31 -0700
Ted Mittelstaedt <te...@ipinc.net> wrote:
> Yahoo's SMTP mailers are unable to handle a standard
> SMTP error 4xx, if they get one they abort the
> transmission and return the message to the sender
Do you have evidence to back up that claim? I don't believe
it's true. We use greylisting and Yahoo's servers don't seem
to have problems with it.
It seems to me that Yahoo just isn't as good as Google or Hotmail
at preventing spammers from signing up and at blocking outbound spam.
Regards,
David.
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Ted Mittelstaedt <te...@ipinc.net>.
this is no surprise
Yahoo's SMTP mailers are unable to handle a standard
SMTP error 4xx, if they get one they abort the
transmission and return the message to the sender
Thus any commercial ISP that wants to retain customers
must exempt all of Yahoo's IP address ranges from
any greylisting filters they have.
This makes the free accounts on the Yahoo mailservers
extremely attractive to spammers to use to relay spam.
It would be a public service for Google to buy Yahoo
and clean it's operations up. Unfortunately Google
is too smart for that.
Ted
On 5/11/2011 1:01 PM, darxus@chaosreigns.com wrote:
> http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
>
> Percentage of total spam from legitimate email providers in April as
> reported as abuse to dnswl.org:
>
> 35.5% yahoo.com
> 6.4% google.com
> 2.9% tp.pl
> 2.3% tin.it
> 1.8% messagelabs.com
> 1.4% hotmail.com
> 1.1% postini.com
> 1.0% orange.fr
> 1.0% aol.com
> 0.8% aruba.it
> 0.8% freenet.de
> 0.6% rediris.es
> 0.3% onet.pl
> 0.3% facebook.com
> 0.3% earthlink.net
> 0.0% kpnxchange.com
> 0.0% eircom.net
> 0.0% sfr.fr
> 0.0% web.de
>
Re: Yahoo sent 5.5x as much spam as any other legit provider in April
Posted by Michael Scheidell <mi...@secnap.com>.
On 5/11/11 4:01 PM, darxus@chaosreigns.com wrote:
> http://www.chaosreigns.com/dnswl/dnswlabusehistory.svg
>
> Percentage of total spam from legitimate email providers in April as
> reported as abuse to dnswl.org:
what is funny, is you said 'yahoo' and 'legit provider' all on one
subject line :-)
I try to tell clients who wonder why they can't get that email from
their home yahoo account, cc'd to 175 employees that if we rate limit
it, yahoo will not even try to resend it.
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
ISN: 1259*1300
>*| *SECNAP Network Security Corporation
* Best Intrusion Prevention Product, Networks Product Guide
* Certified SNORT Integrator
* Hot Company Award, World Executive Alliance
* Best in Email Security, 2010 Network Products Guide
* King of Spam Filters, SC Magazine
______________________________________________________________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.secnap.com/products/spammertrap/
______________________________________________________________________