The problem of backscatter, part 9 - Block it with content analysis

a-foton » The problem of backscatter, part 9 - Block it with content analysis

Mon, 14 Jul 2008 08:34:51 GMT

PingBack from http://blog.a-foton.ru/2008/07/the-problem-of-backscatter-part-9-block-it-with-content-analysis/

re: The problem of backscatter, part 9 - Block it with content analysis

Lee Maguire — Mon, 14 Jul 2008 20:05:36 GMT

By far the most effective filter for DSN messages is

going to be to match RFC3464 bounces:

if sender is <>

and Content-Type: contains "multipart/report"

I have mailserver filters that identify and tag different DSN types. For example, exim generated bounces can be identified by the inclusion of an

"X-Failed-Recipients:" header.

Based purely on the backscatter I've received so far this week:

249 RFC3464

43 nonstandard (exim)

38 nonstandard (qmail)

6 nonstandard (other)

5 nonstandard (exchange)

3 unknown

2 nonstandard (smtp32)

1 nonstandard (type1)

1 nonstandard (old sendmail)

+ 11 other responses (DSNs not using null senders, confirmation requests, googlegroups.com nonsense.)

re: The problem of backscatter, part 9 - Block it with content analysis

Lee Maguire — Mon, 14 Jul 2008 20:19:54 GMT

Also, every time a null sender is used for connection, a check is made on the DNSBL http://www.backscatterer.org/?target=backscatter

and positive hits are tagged on the mail.

Currently 133 hits out of 347 backscatter mails.

re: The problem of backscatter, part 9 - Block it with content analysis

Frank — Tue, 15 Jul 2008 18:27:50 GMT

Other uses of empty reverse paths include auto-responders (RFC 3834), e.g., vacation mails (RFC 5230), and message disposition notifications (RFC 3798). Apart from being difficult blocking all bounces including good bounces is a dubious plan, mail reliability depends on error reports. Even black-listed "backscatterers" can send good (wanted) mails with an empty reverse path. Blocking known "backscatterers" might work for senders never sending mail to them. But where senders are organized enough to guarantee this they can likely also deploy BATV and/or SPF FAIL without losing good bounces.