IETF Logo Mail Archive

Re: [Asrg] rDNS and cache issues, was How will we manage IPv6 spam?

"John Levine" <johnl@taugh.com> Mon, 20 August 2012 16:51 UTC

Return-Path: <johnl@iecc.com>
X-Original-To: asrg@ietfa.amsl.com
Delivered-To: asrg@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 3D0C121F86B7 for <asrg@ietfa.amsl.com>; Mon, 20 Aug 2012 09:51:36 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -111.146
X-Spam-Level:
X-Spam-Status: No, score=-111.146 tagged_above=-999 required=5 tests=[AWL=0.053, BAYES_00=-2.599, HABEAS_ACCREDITED_SOI=-4.3, RCVD_IN_BSP_TRUSTED=-4.3, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id dcyaeTjG29rA for <asrg@ietfa.amsl.com>; Mon, 20 Aug 2012 09:51:35 -0700 (PDT)
Received: from leila.iecc.com (leila6.iecc.com [IPv6:2001:470:1f07:1126:0:4c:6569:6c61]) by ietfa.amsl.com (Postfix) with ESMTP id 3CF2721F86B4 for <asrg@irtf.org>; Mon, 20 Aug 2012 09:51:34 -0700 (PDT)
Received: (qmail 27781 invoked from network); 20 Aug 2012 16:51:32 -0000
Received: from leila.iecc.com (64.57.183.34) by mail1.iecc.com with QMQP; 20 Aug 2012 16:51:32 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=iecc.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50326b14.xn--yuvv84g.k1208; i=johnl@user.iecc.com; bh=IKjxdFKaO5Ex7G1FVlfa3mIgBxU2D3YTfM4u0dG4nWY=; b=YtwgmkwrV9KqKw1Awl9/v1Gw5fu3ZBKN8nznkuzNNIJ4dsvX0bPfx/bx4Qt5pyE3LK+2Ti+vrb9oNgs4B8HoAf5/sw1lX+0yr7vjsFdRm2m91AiHLH4Nsgrqy7r8LzKYC+UzLMGOq6Y77FW/xAcMWyWDEOufxHl5h+o5Lw4bc7c=
DKIM-Signature: v=1; a=rsa-sha256; c=simple; d=taugh.com; h=date:message-id:from:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:vbr-info; s=50326b14.xn--yuvv84g.k1208; olt=johnl@user.iecc.com; bh=IKjxdFKaO5Ex7G1FVlfa3mIgBxU2D3YTfM4u0dG4nWY=; b=VBbP5HysRyfERQOmiQ5lLDnx+Jy8bHjQbCQokmROR6xzaQ7JMWJdmHuyjkAsGfn8SxBSMcbGfToJ9zdBkLhPqsJpu6Gq+H04JjXT9b+MisCIdmY0SAIs860qmD2d3FRTYWOEWX1CmjMDTmHTLvtN4846fu5I8yDNvXMXcR+ryuE=
VBR-Info: md=iecc.com; mc=all; mv=dwl.spamhaus.org
Date: 20 Aug 2012 16:51:10 -0000
Message-ID: <20120820165110.78810.qmail@joyce.lan>
From: "John Levine" <johnl@taugh.com>
To: asrg@irtf.org
In-Reply-To: <CALgnk9oddhOwyuw085963t0CMA6oqEUt_WvuEMST1i5b+ffVLQ@mail.gmail.com>
Organization:
X-Headerized: yes
Mime-Version: 1.0
Content-type: text/plain; charset=utf-8
Content-transfer-encoding: 7bit
Subject: Re: [Asrg] rDNS and cache issues, was How will we manage IPv6 spam?
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/options/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Mon, 20 Aug 2012 16:51:36 -0000

>For the case of abusive behaviour (ie, spammer using vast pools of IP
>addresses, eg > 10^3 IP addresses, either snowshoe-like or in cannon
>style), DNS caches will only blow if receiving systems are "dumb", ie
>do not handle dDoS-like patterns appropriately. That's already an
>issue today, and will only be "somewhat worse" in an IPv6 world.

How can an MTA tell whether a connection from a hitherto unseen IP
is part of a DDoS or a real user sending mail for the first time?

R's,
John

v2.8.7 | Report a Bug | By Email