Subject: [Asrg] Testing that the MX is sensible

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Feb 2006 22:29:35 +0100

Does any other persons use a test on the validity of the MX record of
the sending domain? Not just that there is a MX but also that it is
not a RFC 1918 address or a loopback address? 

Postfix allows it with check_sender_mx_access and I always find it
very useful but it fails with Sourceforge:

https://sourceforge.net/tracker/index.php?func=detail&aid=1435118&group_id=1&atid=200001

_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Richard Rognlie <[email-masked]>
Date: Tue, 21 Feb 2006 16:50:09 -0500

> https://sourceforge.net/tracker/index.php?func=detail&aid=1435118&group_id=1&atid=200001

However, you have to be careful with that technique these days.  
Some people intentionally put RFC1918-ish A records in with
their high MX records.   Figuring that a spammer, who intentionally
targets high MX records, will hit themselves.

Another idea that I've seen some use is to put a valid A record in for
their high MX values.   And any mail that hits there is automatically
spam-trapped.   Since the lower valued MX records should have accepted
the message.   This is fine, so long as one of them *does* and you 
never run into a situation where *all* of your lower MX records
are simultaneously refusing your mail.

-- 
 /  \__  | Richard Rognlie / Sendmail Ninja / Gamerz.NET Lackey
 \__/  \ | http://www.gamerz.net/~rrognlie    <rrognlie at gamerz.net>
 /  \__/ | Creator of [email-masked]
 \__/    |                Helping reduce world productivity since 1994

---

From: Bill Cole <[email-masked]>
Date: Tue, 21 Feb 2006 16:53:46 -0500

>not a RFC 1918 address or a loopback address?

Fairly common.

>https://sourceforge.net/tracker/index.php?func=detail&aid=1435118&group_id=1&atid=200001

One can make a strong argument that the mail cited there should be 
rejected. Mail is supposed to have a deliverable SMTP sender or a 
null SMTP sender, and that is neither. Something at Sourceforge is 
sending mail in a broken and bogus manner.

FWIW, the recent notifications and sitewide updates I have received 
from SourceForge all use [email-masked] or 
[email-masked] so it seems likely to be a non-global problem 
at SourceForge.

-- 
Bill Cole
[email-masked]

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Feb 2006 22:56:49 +0100

On Tue, Feb 21, 2006 at 04:50:09PM -0500,
 Richard Rognlie <[email-masked]> wrote 
 a message of 34 lines which said:

> Some people intentionally put RFC1918-ish A records in with their
> high MX records.  Figuring that a spammer, who intentionally targets
> high MX records, will hit themselves.

Does it really work? It seems very simple for a spamware to test if
the address is not RFC 1918. (A public address, but not allocated by
IANA, or black-holed, would be more sensible.)

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Tue, 21 Feb 2006 23:10:59 +0100

On Tue, Feb 21, 2006 at 04:53:46PM -0500,
 Bill Cole <[email-masked]> wrote 
 a message of 32 lines which said:

> [email-masked] so it seems likely to be a non-global
> problem at SourceForge.

[Postfix tests the RFC 2821 MAIL FROM, not the RFC 2822 From:]

The mail quoted in the bug report was sent in response to a change of
email address, in order to validate it.

---

From: Claus Assmann <[email-masked]>
Date: Tue, 21 Feb 2006 14:18:29 -0800

> not a RFC 1918 address or a loopback address? 

sendmail X supports that:

mxbadip:127.0.0.1	error:551 5.7.1 Bad IP address 127.0.0.1 in MX/A list
mxbadip:192.168.255.255	error:551 5.7.1 Bad IP address 192.168.255.255 in MX/A list

---

From: Bill Cole <[email-masked]>
Date: Tue, 21 Feb 2006 17:40:30 -0500

At 10:56 PM +0100 2/21/06, Stephane Bortzmeyer  imposed structure on 
a stream of electrons, yielding:
>the address is not RFC 1918.

Spammers really are stupid, as is much of the software they use. 
Fingerprints of specific spamware packages that identify mail as 
certain spam tend to survive for years at a time despite being widely 
used, even in open source software like SpamAssassin.

>(A public address, but not allocated by

Unallocated space would not be sensible unless you keep a close watch 
on the allocation process. Intentionally pointing DNS records to 
resources you do not own (because they don't exist) and that someone 
else might create without warning you is bad behavior.

Other approaches like pointing a high MX at a trap machine or at 
another name and IP for the same machine as the lowest-cost MX work 
better without telling lies, breaking perfectly reasonable standards 
enforcement, or risking doing bad things to random strangers.

-- 
Bill Cole
[email-masked]

---

From: Steve Atkins <[email-masked]>
Date: Tue, 21 Feb 2006 14:46:26 -0800

> IANA, or black-holed, would be more sensible.)

Yes, it really works.

Not to a degree that it's actually terribly useful, but don't  
overestimate
how much your typical spamware author knows or cares about such
details.

Cheers,
   Steve

---

From: Stephane Bortzmeyer <[email-masked]>
Date: Wed, 22 Feb 2006 11:54:14 +0100

On Tue, Feb 21, 2006 at 10:29:35PM +0100,
 Stephane Bortzmeyer <[email-masked]> wrote 

> very useful but it fails with Sourceforge:

SourceForge just fixed its email configuration and it now works.

---

From: Tony Finch <[email-masked]>
Date: Wed, 22 Feb 2006 18:12:13 +0000

>not a RFC 1918 address or a loopback address? 

Yes, we do this with Exim. In fact, what we do is strip invalid
targets from the MX list (i.e. RFC 1918 addresses, loopback nets,
example nets, link-local nets, class D and E ranges). If there's
nothing left, the domain is considered invalid.

Tony.
-- 
f.a.n.finch  <[email-masked]>  http://dotat.at/
SHANNON: EAST 4 OR 5, OCCASIONALLY 6 IN SOUTH. SHOWERS. GOOD.