On Mon, Oct 14, 2019 at 4:29 AM Nick via mailop <mailop@mailop.org> wrote:
> On 2019-10-14 11:21 BST, Laura Atkins via mailop wrote: > > Yeah. I think there’s been a bit of a shift back to looking at your > > network space and surrounding IPs. > > Why? > > (I ask this in ignorance of the underlying technicalities, and about > ipv4 only.) > > There are only about 3 billion public ipv4 addresses. I will make the > claim that a few billion entries in a lookup table doesn't seem much > of a challenge, least of all for a party with the kind of resources > that Google has available. > > So why care about the "neighborhood" at all? Why not consider each > and every ipv4 address on its own merits? > Note that I answered this on the thread already. We do keep those stats... if you're small enough, there's no signal there, however. Send 12 messages in 30 days, you're a "low volume sender", and a risk. You're a risk that those very few messages are spear phishing, 419, or other types of attacks that don't take a lot of messages. You're a risk that the IP is just warming up for a multi-million message spam campaign delivered in seconds. You're a risk that your not up to date wordpress gets hacked and used to send a million messages in seconds. Modern spam filters are a combination of good and bad signals, but if you have no good signal... then we only have the bad ones. Personal messages also typically have very low "good" signal in the content, they tend to be short and contain no information. Marketing messages, mailing lists, technical messages[1], these often have much more information in them for content analysis. "Hey Bob, how was your weekend" is pretty content free. When we tell folks that we want them to use SPF & DKIM, what we're looking for is more signals. They aren't "get out of jail free" cards, they're just other ways we can track your reputation. It's what allows us to keep delivering your mail even as you move IP addresses, for example.... or keep sending it to spam. Brandon [1] OTOH, there appears to be a group of folks who mark technical messages as spam, especially patches from lkml, our spam filters have learned that C code is spam multiple times and had to be fixed
_______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
