Re: [Asrg] seeking comments on new RMX article

[Steven F Siirila <[e-mail]>]

On Tue, May 06, 2003 at 12:18:40AM -0700, Scott Nelson wrote:
> 
> >(Yes, reverse DNS can be faked, but that can be reasonably reliably 
> > detected by doing an extra forward lookup of the reverse name.)
> >(Yes, in some
> >cases you must do a little more than just comparing the PTR and A RRs,
> >such as fetching all PTR RRs or all A RRs for the PTR name.)
> 
> Reverse DNS is controlled by the IP.
> If they have an rDNS, you would do about as well by skipping
> the rDNS and using the HELO to do a forward look up.

As mentioned previously on this list, a spammer has control over the EHLO
parameter for open proxies, but has no control over the originating IP
address.  So there is a difference.

> Of course, having rDNS is also a sign of clue, 
> and many spammers are lacking in that which makes the mere presence
> of rDNS a good test.

We are finding rDNS checks to be more and more useful over the past 9 months
as more and more real MTAs are getting "proper" rDNS RRs.  What makes these
checks useful is that the spammer using open proxies and the like has no
control over rDNS configuration, only over the SMTP sessions they create.
We are finding that a lot of sites do not bother setting up rDNS for the
many client workstations they are responsible for.  This makes those very
workstations unable to be abused by spammers (at least for sending to sites
who check rDNS, such as ours).
_______________________________________________
Asrg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/asrg