Security Incidents mailing list archives

Re: ***SPAM*** Re: Massive SPAM Increase {-2.6} {-2.6}


From: benfell () raven cybernude org
Date: Mon, 16 Oct 2006 11:56:44 -0700

On Mon, 16 Oct 2006 13:29:59 -0400, Valdis.Kletnieks () vt edu wrote:
On Mon, 16 Oct 2006 10:04:30 PDT, benfell () raven cybernude org said:
Wrong.  Completely wrong.  Any UNIX-like box with qmail can be configured
to send mail out.  My laptop, for example.  But my domains only receive mail
at the servers designated as MX hosts in DNS.

What Paul is *trying* to do is deal with the fact that any Windows-like
box with spamware is *also* configured to send mail out.

But not all systems are Windows boxes.  And properly operating systems need
not all conform to Paul's expectations of properly operating Windows systems.

This is a fundamental fallacy.

What he's *looking* for is called "SPF", not "outbound MX".

Because my laptop might send mail from just about anwhere, I've had to configure
the SPF in my DNS to say that legitimate mail from my domain might come from
anywere.  This does not help in the slightest to isolate legitimate mail from
my domain from "joe job" mail.

(Whether SPF is actually workable is a different subject entirely - however,
it *is* the closest thing we have to a "standard" on how to tag things the
way Paul is wishing MX were done....)



-- 
David Benfell, LCP
benfell () parts-unknown org
---
Resume available at http://www.parts-unknown.org/

------------------------------------------------------------------------------
This List Sponsored by: Black Hat

Attend the Black Hat Briefings & Training USA, July 29-August 3 in Las Vegas. 
World renowned security experts reveal tomorrow's threats today. Free of 
vendor pitches, the Briefings are designed to be pragmatic regardless of your 
security environment. Featuring 36 hands-on training courses and 10 conference 
tracks, networking opportunities with over 2,500 delegates from 40+ nations. 

http://www.blackhat.com
------------------------------------------------------------------------------


Current thread: