Re: [Asrg] What are the IPs that sends mail for a domain?

[Steve Atkins <[e-mail]>]

On Jun 22, 2009, at 2:53 PM, Rich Kulawiec wrote:

> On Mon, Jun 22, 2009 at 02:59:01PM +0100, Ian Eiloart wrote:
>> We use IP address reputation services because there's nothing else  
>> we can
>> use, in the absence of some way to authenticate the sender address.  
>> Of
>> course, those mechanisms exist and are widely deployed but not
>> universally, or even by a majority of domains. When they become so,  
>> we'll
>> no doubt see domain based reputation services, and even address based
>> reputation services being used as much as IP address reputation  
>> services
>> are.
>
> I don't think so.  Domains and addresses are nearly-free and  
> disposable,
> so spammers could easily render both pointless exercises whenever it
> suited them to do so.  Given that registrars are quite happy to  
> continue
> selling dirt-cheap domains by the thousands to even the worst spammers
> (and registrars ARE spammers) it will always be possible for abusers  
> to
> come up with another domain and another email address -- or another  
> ten
> thousand of each -- whenever it suits them.   Network space is not  
> quite
> so easy to come by, so I think we stand a better chance keeping  
> track of
> allocations.

The critical point here is that while it's easy to cycle through  
domains,
only those who are doing Bad Stuff will do so.

If you're sending wanted email then the reputation associated with any
reputation key (including domains) will increase, and quality of  
delivery
will continue to improve.

If you're sending unwanted email then the associated reputation will
decrease and delivery rates will drop. Because of that, people sending
bad email will cycle through reputation identifiers rapidly, meaning  
that
their reputation is never better than that of a brand new identifier,  
but not
usually much worse.

That makes reputation of this sort (whether it be IP based,  
authenticated
domain based or anything else where it's easy to create a new reputation
key, but hard to steal someone elses) is extremely useful for  
identifying
mail that's likely to be wanted, and not really great for identifying  
mail that's
likely to be unwanted. It's not something that's useful on it's own,  
but it's
incredibly useful when used in conjunction with other approaches.

Cheers,
   Steve