att.net email issues?

Fri Jan 24 23:11:11 UTC 2003

On 1/24/2003 at 2:40 AM, owner-nanog at merit.edu wrote:

> Chris at UUNet help determine this is a rDNS issue.  att.net seems to have
> started rejecting email from mail servers that don't have a proper reverse
> DNS entry.  This is a good thing, even though it is causing me some problems
> at the moment.  Thanks Chris.

> -Jim P.

The question is: is that a knee-jerk reaction to them getting clobbered by
spam, or maybe a knee-jerk reaction for receiving "too much" mail ABOUT
their customers to abuse at att.net ?

Example: 12.158.240.0/23, 12.42.172.0/22, 12.158.224.0/23, 12.158.234.0/23,
12.158.236.0/23:

Jan 24 16:11:03 sonet sendmail[11117]: NOQUEUE: ruleset=check_relay, arg1=if1.dlyforyourinfo.com, arg2=12.158.240.237, relay=if1.dlyforyourinfo.com [12.158.240.237], reject=550 NETBLOCK for CBB/cotennet.com - access for jpmailer.com denied - perpetual mail to non-existing users - Spammers must die.

Upon complaint re: this spamhaus continuing to connect here:

The original message was received at Fri, 24 Jan 2003 16:11:09 -0500 (EST)
from root at localhost

   ----- The following addresses had permanent fatal errors -----
abuse at att.net

   ----- Transcript of session follows -----
... while talking to gateway2.att.net.:
<<< 550 208.241.101.2 must be verifiable in DNS
... while talking to gateway3.att.net.:
>>> QUIT
<<< 550 208.241.101.2 must be verifiable in DNS
... while talking to gateway1.att.net.:
>>> QUIT
<<< 550 208.241.101.2 must be verifiable in DNS
554 abuse at att.net... Service unavailable

(a temporary failure due to renumbering)
Rejecting on broken or non-existing DNS will probably reject mail from
more than 15% of all mail servers on the Internet - guaranteeing a
false positive rate not even matched by the combined 6 DNSBL's I
use - cumulative and with hard 5xx rejects. AT&T on the other hand,
will use DNSBL's when the first snowball emerges from hell unscathed.

Makes you wonder if noc at att.net is missing a lotta mail today -
"gee, za eanternet w0rcks zplend1d todey, duznt eet!" -
think of http://www.despair.com/ap24x30prin.html :)

Last but not least, Level3's tolerance of spamming customers has nothing
on AT&T's ignorance of reports of DoS attacks in the form of address forgery
committed by their spamming customers, or on behalf of said customers, despite
notifying them by fax of such activity. That, and the mindless blather
you receive back from abuse at att.net on very rare occasions when you complain
about their customers hitting your spamtraps (dead users, rejects):
"please forward the header and full body of the spam you received".

Next: "please call 1-900-ATT-ABUSEDESK, get charged $5 for the call,
and use the authorization code given to you in the subject line of
your complaint to guarantee that your message is not shoved into /dev/null"