Re: Dramatic increase in bounce messages to forged addresses

2008-04-04 Thread Benny Pedersen
On Wed, April 2, 2008 21:34, mouss wrote: Anyone knows if backscatterer.org list is safe? If so, one can reject mail if the envelope sender is empty and the client is listed there. http://rfc-ignorant.org/policy-dsn.php Benny Pedersen Need more webspace ?

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Matus UHLAR - fantomas
On Wed, 2 Apr 2008, Justin Mason wrote: John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in real-world terms, it doesn't. So don't worry about it. On

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread mouss
Matus UHLAR - fantomas wrote: On Wed, 2 Apr 2008, Justin Mason wrote: John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Michael Scheidell
Yes, we have also seen it on many of our clients domains. Vbounce helps. -- Michael Scheidell, CTO |SECNAP Network Security Winner 2008 Network Products Guide Hot Companies FreeBSD SpamAssassin Ports maintainer Charter member, ICSA labs anti-spam consortium

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Matus UHLAR - fantomas
Yes, we have also seen it on many of our clients domains. On 03.04.08 14:09, Mark Martinec wrote: Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize legitimate bounces to own mail, such as the BATV scheme (Bounce Address Tag Validation):

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Mark Martinec
Yes, we have also seen it on many of our clients domains. Same here. Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize legitimate bounces to own mail, such as the BATV scheme (Bounce Address Tag Validation): http://mipassoc.org/batv/

VBounce (was: Dramatic increase in bounce messages to forged addresses)

2008-04-03 Thread Matus UHLAR - fantomas
On 03.04.08 07:42, Michael Scheidell wrote: Yes, we have also seen it on many of our clients domains. Vbounce helps. It seems that VBounce doesn't catch quite much of bounces. I was checking bounces in our company's mailbox and bigger part of them didn't hit... I hope that will get better. I

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Justin Mason
Mark Martinec writes: Yes, we have also seen it on many of our clients domains. Same here. Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize legitimate bounces to own mail, such as the BATV scheme (Bounce Address Tag Validation):

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread SM
Hi Mark, At 05:09 03-04-2008, Mark Martinec wrote: Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize legitimate bounces to own mail, such as the BATV scheme (Bounce Address Tag Validation): http://mipassoc.org/batv/

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread Michael Scheidell
+0200 To: users@spamassassin.apache.org Subject: Re: Dramatic increase in bounce messages to forged addresses Yes, we have also seen it on many of our clients domains. Same here. Does anyone have operational experience with a scheme of labeling envelope sender addresses to recognize

Re: Dramatic increase in bounce messages to forged addresses

2008-04-03 Thread John Hardin
On Thu, 3 Apr 2008, Michael Scheidell wrote: I say death penalty to spammers. That's going to be the only truly effective solution. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread mouss
Benny Pedersen wrote: On Wed, April 2, 2008 02:06, William Terry wrote: I mostly lurk here, gleaning bits of wisdom from those far more knowledgeable than me, however... i have no clue either :-) I am getting a dramatic increase in bounce messages with my domain forged sent to

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread Justin Mason
John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in real-world terms, it doesn't. So don't worry about it. Instead, try enabling the vbounce ruleset... --j.

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread ram
On Wed, 2008-04-02 at 10:42 +0200, mouss wrote: Benny Pedersen wrote: On Wed, April 2, 2008 02:06, William Terry wrote: I mostly lurk here, gleaning bits of wisdom from those far more knowledgeable than me, however... i have no clue either :-) I am getting a

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread Dave Pooser
i see other types of backscatter that could be solved by using spf only if spammers check spf before forging addresses, which I doubt... I can say that since I started publishing SPF records at $DAYJOB we've seen a gigantic reduction in backscatter. I think many spammers do try to avoid using

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread John Hardin
On Wed, 2 Apr 2008, Justin Mason wrote: John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in real-world terms, it doesn't. So don't worry about it. Sure it

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread Martin Gregorie
On Wed, 2008-04-02 at 10:08, Justin Mason wrote: John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in real-world terms, it doesn't. So don't worry about

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread mouss
Martin Gregorie wrote: On Wed, 2008-04-02 at 10:08, Justin Mason wrote: John Hardin writes: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? Logically this should have an effect, but in

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread Jo Rhett
On Apr 2, 2008, at 12:34 PM, mouss wrote: no tuning on your side will help solving problems at the other side. For example, I found that hotmail cache the value Yes, they cache the results of that DNS query for exactly how long you tell them to. If you want the SPF record cached less,

Re: Dramatic increase in bounce messages to forged addresses

2008-04-02 Thread mouss
Jo Rhett wrote: On Apr 2, 2008, at 12:34 PM, mouss wrote: no tuning on your side will help solving problems at the other side. For example, I found that hotmail cache the value Yes, they cache the results of that DNS query for exactly how long you tell them to. This is not my observation.

Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread William Terry
I mostly lurk here, gleaning bits of wisdom from those far more knowledgeable than me, however... I am getting a dramatic increase in bounce messages with my domain forged sent to me. At least some of the messages still retain the headers so I can tell that we did not originate the message.

RE: Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread Kurt Buff
Yup. Big rise over the past two weeks. Kurt -Original Message- From: William Terry [mailto:[EMAIL PROTECTED] Sent: Tuesday, April 01, 2008 17:07 To: users@spamassassin.apache.org Subject: Dramatic increase in bounce messages to forged addresses I mostly lurk here, gleaning bits

Re: Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread John Hardin
On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECTED] key: 0xB8732E79 -- 2D8C 34F4 6411

RE: Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread Jeff Koch
increase in bounce messages to forged addresses I mostly lurk here, gleaning bits of wisdom from those far more knowledgeable than me, however... I am getting a dramatic increase in bounce messages with my domain forged sent to me. At least some of the messages still retain the headers so I

Re: Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread Benny Pedersen
On Wed, April 2, 2008 02:06, William Terry wrote: I mostly lurk here, gleaning bits of wisdom from those far more knowledgeable than me, however... i have no clue either :-) I am getting a dramatic increase in bounce messages with my domain forged sent to me. At least some of the messages

Re: Dramatic increase in bounce messages to forged addresses

2008-04-01 Thread William Terry
John Hardin wrote: On Tue, 1 Apr 2008, William Terry wrote: Is there anything I can do to mitigate this? Do you publish SPF records? We haven't as of yet. I have been looking at it though since this last burst of backscatter. Any idea how widely SPF record checking has been adopted out