Detecting very recently registered domain names

2013-12-19 Thread Joe Quinn
We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do not want to get blocked for looking like we are harvesting information. Regards, JMQ

Re: Detecting very recently registered domain names

2013-12-19 Thread Alex
Hi, On Thu, Dec 19, 2013 at 10:02 AM, Joe Quinn jqu...@pccc.com wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically?

Re: Detecting very recently registered domain names

2013-12-19 Thread Joe Quinn
According to this thread of five years ago, that RBL is not very well maintained. I wonder if that's still the case? (http://spamassassin.1065346.n5.nabble.com/New-Day-old-Bread-list-trick-td52989.html) There also don't appear to be any alternative RBLs that provide a similar list. I might

Re: Detecting very recently registered domain names

2013-12-19 Thread Steve Freegard
On 19/12/13 15:50, Joe Quinn wrote: According to this thread of five years ago, that RBL is not very well maintained. I wonder if that's still the case? (http://spamassassin.1065346.n5.nabble.com/New-Day-old-Bread-list-trick-td52989.html) There also don't appear to be any alternative RBLs that

Re: Detecting very recently registered domain names

2013-12-19 Thread Marcin Mirosław
W dniu 19.12.2013 16:13, Alex pisze: Hi, Hi, On Thu, Dec 19, 2013 at 10:02 AM, Joe Quinn jqu...@pccc.com wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol We are noticing a lot of spam coming from domains that are less than two months old.

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Joe Quinn skrev den 2013-12-19 16:02: We are noticing a lot of spam coming from domains that are less than two months old. Is there a good way to detect this automatically? We've thought about whois, but do not want to get blocked for looking like we are harvesting information. maybe make a

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Marcin Mirosław skrev den 2013-12-19 17:47: I've noticed false positives in last days in this rule. 1.5 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) [URIs: imageshack.us] add this domain to uribl_skip_domains dont be fool :)

Re: Detecting very recently registered domain names

2013-12-19 Thread John Hardin
On Thu, 19 Dec 2013, Benny Pedersen wrote: Marcin Mirosław skrev den 2013-12-19 17:47: I've noticed false positives in last days in this rule. 1.5 URIBL_RHS_DOB Contains an URI of a new domain (Day Old Bread) [URIs: imageshack.us] add this domain

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
John Hardin skrev den 2013-12-19 18:31: You shouldn't have to do that. one should not complain either :) hard to be right :(

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 10:13 AM, Alex wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol :-) I'm trying to get more people involved in the project. Speaking of which, I published the crash course on email / spam at

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 18:48, schrieb Kevin A. McGrail: On 12/19/2013 10:13 AM, Alex wrote: Isn't that where Kevin works too? Couldn't you just walk down the hall and ask him? lol :-) I'm trying to get more people involved in the project. Speaking of which, I published the crash course on email /

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good point. I'll add a caveat because mail

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:21, schrieb Kevin A. McGrail: On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Kevin A. McGrail skrev den 2013-12-19 19:21: On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice Thanks. spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Good

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many years.

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Robert Schetterer skrev den 2013-12-19 19:39: not a big problem at all ,in your case, but some marketing people promote spf/dkim/dmarc as some jedi wonder tool against spam, which simply isnt true so what is true ? i really hate ignorants

Re: Detecting very recently registered domain names

2013-12-19 Thread Matus UHLAR - fantomas
On 12/19/2013 1:17 PM, Robert Schetterer wrote: couldnt read that all ,but looks nice spf. dkim, dmarc are not antispam mechs, however they may help sometimes in some spam cases, so do not mix it up with antispam and confuse users Am 19.12.2013 19:21, schrieb Kevin A. McGrail: Good point.

Re: Detecting very recently registered domain names

2013-12-19 Thread Matus UHLAR - fantomas
Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so ago. This compendium has been written over many

Re: Detecting very recently registered domain names

2013-12-19 Thread Kevin A. McGrail
On 12/19/2013 1:47 PM, Matus UHLAR - fantomas wrote: ok, so this is again one site that should be corrected... spf is NOT an anti-spam tool - it is anti-forgery tool. Yes, much of spam is forged but the info above is still wrong... Kevin, please fix that info... Definitely will mark it as

Re: Detecting very recently registered domain names

2013-12-19 Thread Benny Pedersen
Kevin A. McGrail skrev den 2013-12-19 20:14: On 12/19/2013 1:47 PM, Matus UHLAR - fantomas wrote: ok, so this is again one site that should be corrected... spf is NOT an anti-spam tool - it is anti-forgery tool. Yes, much of spam is forged but the info above is still wrong... Kevin, please

Re: Detecting very recently registered domain names

2013-12-19 Thread Robert Schetterer
Am 19.12.2013 19:49, schrieb Matus UHLAR - fantomas: Sender Policy Framework (SPF) - SPF is an anti-spam approach in which the Internet domain ... Am 19.12.2013 19:28, schrieb Kevin A. McGrail: Will clarify but I wouldn't be shocked if that was the description on wikipedia from a year or so