Re: [Asrg] MTX, a distributed DNS whitelist requiring IP and domain ownership

Alessandro Vesely <vesely@tana.it> Wed, 17 February 2010 08:29 UTC

Return-Path: <vesely@tana.it>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 821103A7946 for <asrg@core3.amsl.com>; Wed, 17 Feb 2010 00:29:33 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.683
X-Spam-Level:
X-Spam-Status: No, score=-4.683 tagged_above=-999 required=5 tests=[AWL=0.036, BAYES_00=-2.599, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oO71btEduciw for <asrg@core3.amsl.com>; Wed, 17 Feb 2010 00:29:32 -0800 (PST)
Received: from wmail.tana.it (www.tana.it [62.94.243.226]) by core3.amsl.com (Postfix) with ESMTP id 80AAB3A78E6 for <asrg@irtf.org>; Wed, 17 Feb 2010 00:29:30 -0800 (PST)
Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 515, TLS: TLS1.0,256bits,RSA_AES_256_CBC_SHA1) by wmail.tana.it with ESMTPSA; Wed, 17 Feb 2010 09:31:02 +0100 id 00000000005DC036.000000004B7BA946.00002F7B
Message-ID: <4B7BA947.2050205@tana.it>
Date: Wed, 17 Feb 2010 09:31:03 +0100
From: Alessandro Vesely <vesely@tana.it>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.7) Gecko/20100111 Thunderbird/3.0.1
MIME-Version: 1.0
To: asrg@irtf.org
References: <20100215183810.GS27977@chaosreigns.com>
In-Reply-To: <20100215183810.GS27977@chaosreigns.com>
Content-Type: text/plain; charset="us-ascii"; format="flowed"
Content-Transfer-Encoding: 7bit
Subject: Re: [Asrg] MTX, a distributed DNS whitelist requiring IP and domain ownership
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Wed, 17 Feb 2010 08:29:33 -0000

On 15/Feb/10 19:38, Darxus@ChaosReigns.com wrote:
> Basically the entire thing is:
>
> 1) Receive an email from IP.
> 2) Get host name from PTR record value for IP.

/Any/ PTR, or should one test all of them? How about virtual servers?

> 3) Get value of A record named IPReversed.mtx.HostName.
> 4) If the value is 127.*.*.1: Pass.  Otherwise: Fail.
>
> Blacklisting, of course, is required.  I believe maintaining a blacklist
> of (non-throwaway) spammer domains using MTX (against the sending IP's
> PTR record), and possibly IP's which spam with MTX, will be significantly
> easier than maintaining current IP blacklists.

Why wouldn't spammers change domain as often as they wish? They 
already register all the throwaway domains they like... I cannot see 
why MTX would slow them down.

> I believe the more this is adopted, the more spammers will be required to
> own the transmitting IP *and* a throwaway domain.

Non-spammers will be required too, of course :-/