Re: [Asrg] Statistical Analysis shows SPF should work Pretty Well

> From: mengwong@dumbo.pobox.com (Meng Weng Wong)

> ...
> Conclusion 1: aol, hotmail, and yahoo have successfully implemented
> outbound antispam technology, ie. ways to ensure that only humans sign
> up for their accounts, or limits on per-account outbound message volume.

Success is certainly is fleeting.  See
  http://www.google.com/search?q=hotmail+dav
  http://news.google.com/news?q=hotmail+dav
  http://www.vnunet.com/News/1141514
I've also seen recent reports from usually reliable sources that
Microsoft's account creation mechanism has been "scripted."

A summmary of all of that is that in recent weeks spammers have been
significant spam through Hotmail systems.

This goes to show that questions (not just statements) about whether
characteristics of spam (or spam defenses) occur some of the time or
most of the time should be view critically.  Measurements of spam
can be useful for showing that a characteristic (practically?) always
or never occurs in spam or that a tactic of spammers or spam defenses
always or never works.  Concluding much from a measurement that
says "X happens 90%" (or 9%) is often an error.

> ...
> Conclusion 2: Client IPs whose PTR do not match their sender domains are
> more likely to be spam than not.
>
> But that means a scheme like SPF/DMP/RMX should work nicely.

Does that imply that your definition of "work nicely" allows as many
as 50% false positives?

Vernon Schryver    vjs@rhyolite.com
_______________________________________________
Asrg mailing list
Asrg@ietf.org
https://www1.ietf.org/mailman/listinfo/asrg