[CLUE-Talk] help with spammer information

[Nate Duehr]

Matt Gushee wrote:
> On Tue, Nov 02, 2004 at 08:52:28PM -0700, Mike Staver wrote:
> 
>>Somebody is now using my email address staver at fimble.com to send spam, 
>>and for one week now I've been getting nothing but bounce back messages 
>>to addresses that no longer exist.  I'm getting EXTREMELY irritated that 
>>there is nothing I can do to stop these messages from going out with my 
>>email address as the from field.  My domain name fimble.com is getting a 
>>bad rap over this,
> 
> 
> Well, maybe. If you mean that your domain could end up on somebody's
> half-assed blacklist of spammers, or get filtered out by half-assed
> filtering software, that's probably possible and a legitimate cause for
> concern.

It's defintely not fun.  The generic term for this is a "Joe Job". 
Googling for it will find some interesting stuff and plenty of horror 
stories.

One of the only viable ways to stop it right now is SPF, and so many 
people are not blacklisting and dropping on bad SPF hits, it probably 
isn't as effective as it could be.

Until there's a public trusted clearing house for authentication keys 
and mail servers are issued individual keys for identification, the 
evilness will continue.  And some would argue that mailservers being 
identified is also evil, in many ways.  :-(

On the "good news" front, I've noticed that probably 40% of my outbound 
mail seems to be traversing via TLS these days, automatically.  I have 
your standard "hey I'm too cheap to buy a certificate, here's my 
self-signed one" installed on the mail server and apparently people are 
still allowing the TLS connections and accepting the mail and the 
additional overhead of enencrypting it at 40% of the mail servers I talk 
to.  Kinda nifty to see that admins are generally allowing that.

--
Nate Duehr, nate at natetech.com