Is anti spam getting more of a problem than spam?

**Sysman** · 14 May 2011, 16:52

One thing I've been seeing for a year or more is that emails with an invalid sender address get marked as potential spam by my ISP.

It was definitely something my ISP did, since emails from one of my own websites suddenly started doing this. I fixed it by putting a valid address somewhere in the site setup.

The mails concerned come with "*** Sender address does not exist ***" prepended to the subject line.

I have tried educating some webmasters about this, but some of them don't seem to know how to fix it.

**xoggoth** · 14 May 2011, 17:07

Cheers sysman. Don't have that error but I do have an SPF authentication error in the header.

Should be fixed by correct SPF record (as hosting support gave me and checked) but it isn't. Error also apparently caused by no reverse DNS, no means of setting that as far as I can see, hosting help brings up nothing.

Lot of stuff on net indicates gmail is a particular problem, few conspiracy theories on that too.

**blacjac** · 16 May 2011, 12:41

Reverse DNS certainly could be a problem, but in order to sort this you will have to go through the ISP of the internet connection the mail server is connected to.

E.g. my mailserver is in my house, I had to get PlusNet to add the reverse DNS to their DNS servers to stop this happening. Before they would do it I had to prove I owned the domain I was asking for a reverse DNS record for by setting up a subdomain's A record to an IP address they gave me.

**Sysman** · 19 May 2011, 10:13

Originally posted by xoggoth View Post

Cheers sysman. Don't have that error but I do have an SPF authentication error in the header.

Should be fixed by correct SPF record (as hosting support gave me and checked) but it isn't. Error also apparently caused by no reverse DNS, no means of setting that as far as I can see, hosting help brings up nothing.

Lot of stuff on net indicates gmail is a particular problem, few conspiracy theories on that too.

I know very little about SPF records, as I haven't needed to use them (yet?). I did check my own mail server set up and there aren't any.

Reverse DNS is a little more tricky. From the Reverse DNS lookup Wiki:

Multiple pointer records

While most rDNS entries only have one PTR record, DNS does not restrict the number. However, having multiple PTR records for the same IP address is generally not recommended, unless there is a specific need. For example, if a web server supports many virtual hosts, there may be one PTR record for each host and some versions of name server software will allocate this automatically. Multiple PTR records can cause problems, however, including triggering bugs in programs that only expect single PTR records and, in the case of a large web server, having hundreds of PTR records can cause the DNS packets to be much larger than normal.

As an example of the number of checks performed by anti-spam measures, here's an extract of an email I got yesterday:

Code:

Content analysis details:   (32.4 points, 4.0 required)

pts rule name              description
---- ---------------------- --------------------------------------------------
2.7 RCVD_IN_PSBL           RBL: Received via a relay in PSBL
                           [41.212.2.11 listed in psbl.surriel.com]
1.6 RCVD_IN_BRBL_LASTEXT   RBL: RCVD_IN_BRBL_LASTEXT
                           [41.212.2.11 listed in bb.barracudacentral.org]
3.4 FSL_CTYPE_WIN1251      Content-Type only seen in 419 spam
1.2 NSL_RCVD_FROM_USER     Received from User
0.0 DKIM_ADSP_CUSTOM_MED   No valid author signature, adsp_override is
                           CUSTOM_MED
1.0 SPF_SOFTFAIL           SPF: sender does not match SPF record (softfail)
1.6 SUBJ_ALL_CAPS          Subject is all capitals
2.5 MILLION_USD            BODY: Talks about millions of dollars
0.0 HTML_MESSAGE           BODY: HTML included in message
1.1 MIME_HTML_ONLY         BODY: Message only has text/html MIME parts
1.1 DCC_CHECK              Listed in DCC (http://rhyolite.com/anti-spam/dcc/)
0.6 FORGED_OUTLOOK_TAGS    Outlook can't send HTML in this format
0.0 LOTS_OF_MONEY          Huge... sums of money
0.0 FROM_MISSPACED         From: missing whitespace
0.5 FROM_MISSP_MSFT        From misspaced + supposed Microsoft tool
0.0 FROM_MISSP_EH_MATCH    From misspaced, matches envelope
0.0 FROM_MISSP_DKIM        From misspaced, DKIM dependable
3.4 MSOE_MID_WRONG_CASE    MSOE_MID_WRONG_CASE
0.0 FORGED_OUTLOOK_HTML    Outlook can't send HTML message only
0.7 FROM_MISSP_TO_UNDISC   From misspaced, To undisclosed
1.5 FROM_MISSP_USER        From misspaced, from "User"
2.0 MONEY_FROM_MISSP       Lots of money and misspaced From
1.2 NML_ADSP_CUSTOM_MED    ADSP custom_med hit, and not from a mailing list
0.0 MONEY_LOTTERY          Lots of money from a lottery
0.5 ADVANCE_FEE_3_NEW      Appears to be advance fee fraud (Nigerian 419)
0.5 ADVANCE_FEE_2_NEW_MONEY Advance Fee fraud and lots of money
2.8 FORGED_MUA_OUTLOOK     Forged mail pretending to be from MS Outlook
1.0 ADVANCE_FEE_3_NEW_MONEY Advance Fee fraud and lots of money
0.5 MONEY_FRAUD_5          Lots of money and many fraud phrases
1.0 MONEY_FRAUD_3          Lots of money and several fraud phrases

The original message was not completely plain text, and may be unsafe to
open with some email clients; in particular, it may contain a virus,
or confirm that your address can receive spam.  If you wish to view
it, it may be safer to save it to a file and open it with an editor.

This one is a first for me. I've never seen one with so many entries before.

**DaveB** · 19 May 2011, 10:36

Just wait till IPv6 really takes of. The address space for potential spammers will explode and none of the existing Black Hole Lists are going to be able to cope.

**xoggoth** · 19 May 2011, 13:43

Cheers. Spent hours on problem and no solutions. This whole things seems incomprehensible. Host support have been looking at it and no answers yet.

**xchaotic** · 19 May 2011, 14:21

In other news, anti-virus is a more of a problem than viruses.
I inherited a Win7 box with AVG, I uninstalled an exipred trial of it )still kind of worked but I found it useless hog)
The next day they send an update which breaks windows cause blue screens and you have to reinstall windows, I so nearly avoided it.

In any case why are micromanaging your mail server and not use some ready solution like Google Apps?
Is it because you want to send bulk, unsolicited mail to thousands of users on the cheap?

Is anti spam getting more of a problem than spam?