Re: [Asrg] spam down?

Chris Lewis <> Sat, 26 January 2013 16:03 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 547EF21F8619 for <>; Sat, 26 Jan 2013 08:03:14 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: 0.441
X-Spam-Status: No, score=0.441 tagged_above=-999 required=5 tests=[BAYES_05=-1.11, FH_RELAY_NODNS=1.451, RDNS_NONE=0.1]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id Rnu8yztN7L7I for <>; Sat, 26 Jan 2013 08:03:11 -0800 (PST)
Received: from (unknown []) by (Postfix) with ESMTP id AAA5421F8551 for <>; Sat, 26 Jan 2013 08:03:10 -0800 (PST)
Received: from [] ( []) (authenticated bits=0) by (8.14.4/8.14.4/Debian-2ubuntu2) with ESMTP id r0QG32sj009145 (version=TLSv1/SSLv3 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NOT) for <>; Sat, 26 Jan 2013 11:03:03 -0500
Message-ID: <>
Date: Sat, 26 Jan 2013 11:03:02 -0500
From: Chris Lewis <>
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-GB; rv: Gecko/20090812 Thunderbird/ Mnenhy/
MIME-Version: 1.0
References: <>
In-Reply-To: <>
X-Enigmail-Version: 1.4.6
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Subject: Re: [Asrg] spam down?
X-Mailman-Version: 2.1.12
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <>
List-Id: Anti-Spam Research Group - IRTF <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sat, 26 Jan 2013 16:03:14 -0000

On 13-01-26 08:38 AM, Michael Thomas wrote:
> There was a little side box in the current Economist that spam was
> down from 80+% to 67% and credited it to, among other things
> "sophisticated authentication" which I assume means DKIM and SPF.
> First is there actual evidence that spam is on the wane? And if so,
> does it actually have to due in part with authentication? I'd be
> ecstatic to hear that the latter was true, but correlation is not
> causation.

In the wane ... how?  Is the real question.

Absolute volumes have indeed changed, as this graph (and many others) show:

but that doesn't tell the whole story.

The reality is that authentication (we're talking DKIM/SPF/DMARC) has
relatively little effect.  They're pretty easy to make irrelevant.

There are fewer bot families than there used to be.  Bot takedowns have
made major inroads.   Still, there are a couple left that can dwarf what
we've seen before _if_ it was attractive to fire them off.  Kelihos and
Festi are bigger than Rustock or Srizbi ever were.  The defenses we have
for bots are well-developed and widely-deployed.  The ROI has declined
markedly, so the bot armies are often left idle.

What we're seeing instead, is an evolution from the massive
scatter-gunning of a Rustock infecting a home computer, to that of
compromised servers, compromised user accounts etc.  These are harder to
deal with, harder to stop, harder to filter.

So, while there are fewer spams in the Internet, I strongly suspect that
more of them are getting through.

Spammers may not be spamming as much but they are spamming "better".