Spammers Skirt IP Authentication Attempts

Paul Vixie vixie at vix.com
Wed Sep 8 23:46:36 UTC 2004


> > I see that 56trf5.com is a real domain. Does this mean that the domain
> > name registries and DNS are now being polluted with piles of garbage
> > entries in the same way that Google searches have been polluted with
> > tons of pages full of nothing but search keywords and ads?
> > 
> 
> Yes - and there's a list of such domains that we track published as the
> ob.surbl.org zonefile (http://www.surbl.org for details)

the way i can prove that this methodology is only employed by a minority
of very-smart MTA operators is: "that it's effective."  if it were widely
used, such that it affected global spam volume and thus spammer revenue,
then the spammers would switch to different tricks.

MAPS RBL was intended to be immune to this reflexive failure mode because
it targetted address space, which was a scarcer commodity than domain names.

i recommend against deployment of anti-spam methodologies whose only
guaranteed effect is to force spammers to have to be smarter.  (they will!)
-- 
Paul Vixie



More information about the NANOG mailing list