Re: [Asrg] What are the IPs that sends mail for a domain?

Ian Eiloart <iane@sussex.ac.uk> Fri, 19 June 2009 08:52 UTC

Return-Path: <iane@sussex.ac.uk>
X-Original-To: asrg@core3.amsl.com
Delivered-To: asrg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 9DB8C3A6B16 for <asrg@core3.amsl.com>; Fri, 19 Jun 2009 01:52:09 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.863
X-Spam-Level:
X-Spam-Status: No, score=-1.863 tagged_above=-999 required=5 tests=[AWL=-0.660, BAYES_00=-2.599, MIME_QP_LONG_LINE=1.396]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id l01KGzgakZfD for <asrg@core3.amsl.com>; Fri, 19 Jun 2009 01:52:08 -0700 (PDT)
Received: from lynndie.uscs.susx.ac.uk (lynndie.uscs.susx.ac.uk [139.184.14.87]) by core3.amsl.com (Postfix) with ESMTP id A0D103A67F0 for <asrg@irtf.org>; Fri, 19 Jun 2009 01:52:08 -0700 (PDT)
Received: from lewes.staff.uscs.susx.ac.uk ([139.184.134.43]:56176) by lynndie.uscs.susx.ac.uk with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.64) (envelope-from <iane@sussex.ac.uk>) id KLHA0X-000J39-4R for asrg@irtf.org; Fri, 19 Jun 2009 09:53:21 +0100
Date: Fri, 19 Jun 2009 09:52:16 +0100
From: Ian Eiloart <iane@sussex.ac.uk>
Sender: iane@sussex.ac.uk
To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
Message-ID: <543E228707C23A181637F512@lewes.staff.uscs.susx.ac.uk>
In-Reply-To: <200906182044.QAA05200@Sparkle.Rodents-Montreal.ORG>
References: <9112777.1871245190785748.JavaMail.franck@iphone-4.genius.local> <Pine.GSO.4.64.0906161906450.27272@nber6.nber.org> <4D8E56D2-CB37-4713-94E5-0F0C2A1B1F94@blighty.com> <2F26F23C-F1B4-4FD4-BAEB-53168072FF5D@mail-abuse.org> <200906180105.VAA21834@Sparkle.Rodents-Montreal.ORG> <C8F0F10E-E1A4-4D25-AF20-31E3F0DB68DF@mail-abuse.org> <200906182044.QAA05200@Sparkle.Rodents-Montreal.ORG>
Originator-Info: login-token=Mulberry:01wYzFqirtMw8C+RkMLbI0ATgdJwTmBCSyNvc=; token_authority=support@its.sussex.ac.uk
X-Mailer: Mulberry/4.0.8 (Mac OS X)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
X-Sussex: true
X-Sussex-transport: remote_smtp
Subject: Re: [Asrg] What are the IPs that sends mail for a domain?
X-BeenThere: asrg@irtf.org
X-Mailman-Version: 2.1.9
Precedence: list
Reply-To: Anti-Spam Research Group - IRTF <asrg@irtf.org>
List-Id: Anti-Spam Research Group - IRTF <asrg.irtf.org>
List-Unsubscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=unsubscribe>
List-Archive: <http://www.irtf.org/mail-archive/web/asrg>
List-Post: <mailto:asrg@irtf.org>
List-Help: <mailto:asrg-request@irtf.org?subject=help>
List-Subscribe: <http://www.irtf.org/mailman/listinfo/asrg>, <mailto:asrg-request@irtf.org?subject=subscribe>
X-List-Received-Date: Fri, 19 Jun 2009 08:52:09 -0000

--On 18 June 2009 15:19:24 -0400 der Mouse <mouse@Rodents-Montreal.ORG> 
wrote:

>> Have you heard of SPF?
>
> Yes.  It flopped, no?  If it had been widely adopted, I might have to
> decide whether I think it constitutes "pushing responsibility to the
> edge".  But I don't.
>

No, it hasn't flopped. It just hasn't reached critical mass yet.
<http://www.openspf.org/Statistics>  has some interesting stuff, including 
reports by Microsoft of their experience of SenderID, from Google of their 
positive experience with SPF and DKIM.

These surveys show the rate of growth of SPF record publication:

<http://dns.measurement-factory.com/surveys/>
2005 - not measured
2006 - 6% of 1,756,827 zones with at least one working nameserver published 
SPF records
2007 - 12.6% of 2,053,150 ''
2008 - 16.72% of 1,000,000 ''


Google's conclusion: "Reputation based upon the authenticated sender’s 
domain works well for us. Spammers are easily identified, as are good 
senders. Only a few senders end up in the grey area in between, and for 
these we still have the traditional statistical filtering methods for 
classification. It is not without a few problems though, but we think they 
are small enough that they can be worked out eventually. We think 
reputation systems can work well for others too, and we hope to see more 
senders authenticating and observing good sending practices because of it."

They're referring to a combination of SPF (good for early decisions, based 
on recipient preferences) and DKIM (protects forwarded email).

-- 
Ian Eiloart
IT Services, University of Sussex
01273-873148 x3148
For new support requests, see http://www.sussex.ac.uk/its/help/