Subject: Fwd: [rt.ietf.org #24364] mail.ietf.org. is ietf.org., Remove MX Records For Less Spam

From: Sabahattin Gucukoglu <[email-masked]>
Date: Fri, 26 Feb 2010 04:11:39 +0000

Discussion, please.  See below for my take; the IETF is one host, MX is really meaningless, and there are benefits to avoiding a ton of spambot zombie spam.

Begin forwarded message:
> From: "Glen via RT" <[email-masked]>
> Date: 25 February 2010 18:16:44 GMT
> To: [email-masked]
> Subject: [rt.ietf.org #24364] mail.ietf.org. is ietf.org., Remove MX Records For Less Spam 
> Reply-To: [email-masked]
> in-reply-to: <[email-masked]>
> references: <[email-masked]> <[email-masked]>
> message-id: <[email-masked]>
> rt-ticket: rt.ietf.org #24364
> rt-originator: [email-masked]
> 
> Thank you!
> 
> Regrettably, we got many MANY complaints in the past from IETF community
> members who objected strongly to the absence of MX records.  So although
> I personally feel as you do, I cannot make the suggested change at this
> time.
> 
> Perhaps the spirit of things has changed.  You are welcome to bring this
> up on the IETF list if you want, and to quote this response.  Having
> been beaten down once, I'm not prepared to fight that battle again just
> yet.  :-)
> 
> Glen
> 
> On Thu Feb 25 06:08:22 2010, [email-masked] wrote:
>> In the spirit of abiding by the rules we strive so hard to write ...
>>   :-)
>> 
>> mail.ietf.org. is ietf.org., so you can remove your MX records for
>>   ietf.org.  This should cut down on spam since a lot of spambots
>>   will skip over domains whose MX list cannot be obtained.  Real
>>   mailers will of course fall back to A/AAAA as per RFC 2821/5321.  A
>>   few hosts will have trouble, but very, very few indeed, and that
>>   isn't your (our?) fault.
>> 
>> Cheers,
>> Sabahattin

---

From: John Levine <[email-masked]>
Date: 26 Feb 2010 06:49:03 -0000

>Discussion, please.  See below for my take; the IETF is one host, MX is really meaningless, and there are
>benefits to avoiding a ton of spambot zombie spam.

That's not a very good idea.  I wouldn't count on zombies ignoring the
IETF, nor would I count on there not being real MTAs that will hiccup
if there's no MX.  I've certainly seen filtering setups that view mail
from domains without MX records with scepticism, since there would now
be no techincal difference between mail from the IETF and mail from a
bot-infected wifi printer.

If you want to filter the spam, filter the spam like everyone else
does.  It's not rocket science.  Don't set a bad example for the rest
of the world.

R's,
John

---

From: Dave CROCKER <[email-masked]>
Date: Fri, 26 Feb 2010 16:24:19 +0800

MX records are the norm.  There is even a constituency in the email ops 
community that believes use of A (and AAAA) records should be deprecated.

In any event, the kind of anti-abuse techniques that are predicated on having 
abusers be lazy or sloppy has, at best, short-term benefits, because the bad 
actors are quite good at adapting.

d/

On 2/26/2010 12:11 PM, Sabahattin Gucukoglu wrote:
>> From: "Glen via RT"<[email-masked]>
>> in-reply-to:<[email-masked]>
>> references:<[email-masked]>  <[email-masked]>
>> message-id:<[email-masked]>
> _______________________________________________
> Ietf mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ietf
>

-- 

   Dave Crocker
   Brandenburg InternetWorking
   bbiw.net

---

From: John Levine <[email-masked]>
Date: 26 Feb 2010 15:42:01 -0000

>>>   few hosts will have trouble, but very, very few indeed, and that

I checked with some people who run mail for a lot of domains, and they
assure me that spambots will try to deliver to the A record even if
there is an MX.  Where did you get the idea that not having an MX
offers protection from spambots?

R's,
John

---

From: SM <[email-masked]>
Date: Fri, 26 Feb 2010 08:45:51 -0800

Hi Sabahattin,
At 20:11 25-02-10, Sabahattin Gucukoglu wrote:
>Discussion, please.  See below for my take; the IETF is one host, MX 
>is really meaningless, and there are benefits to avoiding a ton of 
>spambot zombie spam.

While we are on this topic, which of the following methods would you 
recommend for a point of contact:

   1. mailto [1] [2] [7] [8] [10] [12] [13]

   2. email address without mailto [9]

   3. AT [3]

   4. at [4] [11]

   5. & [5]

   6. email address as an image [6]

Regards,
-sm

1. http://www.ietf.org/secretariat.html
2. http://www.icann.org/en/announcements/announcement-18feb10-en.htm
3. http://www.iab.org/about/members.html
4. http://www.itu.int/ITU-T/othergroups/ipv6/
5. http://www.iana.org/assignments/dns-parameters
6. http://www.rfc-editor.org/
7. https://www.arin.net/announcements/2010/20100224.html
8. http://www.ripe.net/news/2010-be-heard.html
9. http://www.apnic.net/publications/news/2010/apnic-29-consultation
10. http://lacnic.net/en/anuncios/2010_lacnicxiii-becas.html
11. http://www.afrinic.net/press_release_le_050210.htm
12. http://isoc.org/wp/newsletter/?p=1567
13. http://www.un.int/wcm/content/site/portal

---

From: Michael Loftis <[email-masked]>
Date: Fri, 26 Feb 2010 09:59:56 -0700

--On Friday, February 26, 2010 6:49 AM +0000 John Levine <[email-masked]> 
wrote:

>> Discussion, please.  See below for my take; the IETF is one host, MX is
>> really meaningless, and there are benefits to avoiding a ton of spambot
>> zombie spam.
>

I very much agree with this statement.  Not having an MX won't do a single 
bit of good against bots.  In fact I'd argue the *opposite* case, that not 
having an A record does more.  They definitely seem to deliver more often 
to the A rather than the MX.  Having worked at and built a number of large 
hosting operations where the WWW servers (A records) would get *LOTS* of 
SPAM bot attempts.

I'd argue not having an MX will cause far more problems with legitimate 
mail servers and e-mail activity.

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sat, 27 Feb 2010 07:47:04 +0000

On 26 Feb 2010, at 15:42, John Levine wrote:
mail.ietf.org. is ietf.org., so you can remove your MX records for
> offers protection from spambots?

That's interesting, but not what I described.

To answer your question, you'd have to try that for yourself.  I am now getting mostly phishes and scams, but very few member enhancement, expensive watches, wonder cures or viral mails.  A few, of course - but not many.  And yes, some of them are originated from PBL-listed addresses.

Oh, and an IPv6-enabled foreign language spam or three.  Lovely.  The spammers have got there first.

Brief and superficial inspection shows that the scams and phishes are submitted mostly via webmails and legit relays.  I'm not sure why that is, though I have read stories about hijacked Internet cafes.

Cheers,
Sabahattin

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sat, 27 Feb 2010 08:25:38 +0000

On 26 Feb 2010, at 16:45, SM wrote:
At 20:11 25-02-10, Sabahattin Gucukoglu wrote:
> While we are on this topic, which of the following methods would you recommend for a point of contact:
> 

The only one I object to strongly is 6, and that's because I can't see it and nor can anybody using a textmode browser.  Other than that, it makes sense to avoid spam by not doing 1 or 2, although I would sooner not hide from spammers by breaking functionality, which 2-5 implies.

Cheers,
Sabahattin

---

From: "John R. Levine" <[email-masked]>
Date: 27 Feb 2010 08:49:09 -0500

> That's interesting, but not what I described.

Well, OK.  Let me rephrase my question: why do you believe that removing 
the IETF's MX record will

a) decrease the amount of spam it receives?

b) not damage its legitimate mail flow?

Based on my experience and that of other people, neither is true.

R's,
John

---

From: John C Klensin <[email-masked]>
Date: Sat, 27 Feb 2010 12:35:23 -0500

+1

--On Saturday, February 27, 2010 08:49 -0500 "John R. Levine"
<[email-masked]> wrote:

>>> there is an MX.  Where did you get the idea that not having
>>> an MX offers protection from spambots?
>> 
> Well, OK.  Let me rephrase my question: why do you believe
> that removing the IETF's MX record will
>

---

From: Sabahattin Gucukoglu <[email-masked]>
Date: Sun, 28 Feb 2010 06:59:10 +0000

On 27 Feb 2010, at 13:49, John R. Levine wrote:
there is an MX.  Where did you get the idea that not having an MX
> Well, OK.  Let me rephrase my question: why do you believe that removing the IETF's MX record will
> 

Because, on inspection, both now and in the past, that is what it seems to do, for my personal domains.  The difference in spam, and the apparent lack of lost mail, leads me to the conclusion that this small hack is worth the keeping, for now.  Of course, I am more concerned about the lost mail, and I suspect that the IETF is more exposed to that possibility.  In that case, it would be unwise.  But it works for me, and given that it's in no way improper or non-standard, I don't see why it shouldn't for the IETF.

> Based on my experience and that of other people, neither is true.

O.K.  I must be very lucky indeed.

Cheers,
Sabahattin

---

From: Basil Dolmatov <[email-masked]>
Date: Sun, 28 Feb 2010 11:15:53 +0300

+1