Re: [gentoo-server] SPAM protection by requesting confirmation

[Ramon van Alteren]

Alex Efros wrote:
> Hi!
>
> On Mon, Sep 22, 2008 at 07:53:57PM +0200, Thilo Bangert wrote:
>> i've heard of cases, where spammers used the subscribe address of
>> mailinglists as envelope sender. an out-of-office reply is sent to the
>> subscribe address from the target of the spam - the mailing list software
>> sends a confirmation mail - the autoresponder correctly authorises the
>> the subscription request.
>>
>> ...but then again, thats what you get for sending out-of-office
>> autoresponses.
>
> Sorry for OT, but I wanna install spam-protection tool based on
> confirmation email request (somebody send me email, my tool delay that
> email and automatically reply requesting confirmation, he confirm, my tool
> receive that confirmation and: 1) add his email to while-list; 2) deliver
> his initial email to my mailbox). I'm aware about several such tools, but
> I'm not sure how they handle incoming emails from other robots - like mail
> lists, or some news subscriptions and notifications from websites.
>
> I just don't wanna put myself in position like other people who spam
> maillists I read with senseless messages from their tools like
> autoresponders or so...
>
> Can anybody recommend me tool which is able to correctly handle these cases?
> To be honest, I don't see a way to realize this feature... :(
> Ability to protect all accounts at our email domain is good to have, but
> personal-only tool is acceptable too. (I use qmail, if this is important.)
>

I would recommend not to implement such a tool.

1) I wouldn't send you mail anymore if you made me jump through hoops to
confirm that me is actually I.
2) I personally think it's a stupid way of dealing with the problem
3) I can't see any way to get them to work with lists

1) and 2) are obviously very personally biased & opinionated :-)

Judging from the mail/spam volumes at my work, you might be very happy
if you just implemented grey-listing. This basically tells every new
sender of email (or email-address, depends on implementation) to go and
come back in 5 minutes. It sends a 4xx status code, which tells the
sender that the mailserver is currently unable to accept mail, but will
do so in a short while.

Most greylisting tools automaically whitelist senders if they come back
for a configurable period of time.

Since most spammers, virii and other bogus mailsenders do not implement
a full queue-ing system to redeliver mail at a later time if they
receive a 4xx response they bugger off to harass other poor souls on the
internet.

Since most legit mailsenders actually use a mailserver with a queueing
system they resend the mail within the specified period and mail gets
delivered.

As a bonus, it's absolutely low-impact on your mailserver wrt performance.

Dropped spam ratio with > 60% for me, the rest is taken care of by the
usual combination of (automated) blacklisting and spamassasin.

If you use postfix it is as simple as emerge postgrey and go read the
manual.

Just my 2 cts

Ramon