I haven't noticed this before, but in the last several hours, I'm seeing spammers on subscriber networks sending 1000's of HELO hostnames with random domain labels under .com:
from=<[EMAIL PROTECTED]> helo=<fehgpq.com> from=<[EMAIL PROTECTED]> helo=<fejnch.com> from=<[EMAIL PROTECTED]> helo=<fesyuj.com> from=<[EMAIL PROTECTED]> helo=<fetjdz.com> from=<[EMAIL PROTECTED]> helo=<fetjdz.com> from=<[EMAIL PROTECTED]> helo=<fevlgk.com> from=<[EMAIL PROTECTED]> helo=<fevlgk.com> from=<[EMAIL PROTECTED]> helo=<fevmkk.com> from=<[EMAIL PROTECTED]> helo=<fevzon.com> from=<[EMAIL PROTECTED]> helo=<fevzon.com> from=<[EMAIL PROTECTED]> helo=<feyzmv.com> from=<[EMAIL PROTECTED]> helo=<fflbnk.com> from=<[EMAIL PROTECTED]> helo=<fflbnk.com> from=<[EMAIL PROTECTED]> helo=<ffmajs.com> from=<[EMAIL PROTECTED]> helo=<ffmajs.com> from=<[EMAIL PROTECTED]> helo=<ffrrep.com> from=<[EMAIL PROTECTED]> helo=<ffvene.com> from=<[EMAIL PROTECTED]> helo=<ffvene.com> from=<[EMAIL PROTECTED]> helo=<fghdgj.com> from=<[EMAIL PROTECTED]> helo=<fgqrlv.com> from=<[EMAIL PROTECTED]> helo=<fgqrlv.com> from=<[EMAIL PROTECTED]> helo=<fgvdxr.com> from=<[EMAIL PROTECTED]> helo=<fgzvcq.com> from=<[EMAIL PROTECTED]> helo=<fgzvcq.com> from=<[EMAIL PROTECTED]> helo=<fhehap.com> from=<[EMAIL PROTECTED]> helo=<fhehap.com> from=<[EMAIL PROTECTED]> helo=<fhhoer.com> from=<[EMAIL PROTECTED]> helo=<fhhohl.com> from=<[EMAIL PROTECTED]> helo=<fhkbtu.com> from=<[EMAIL PROTECTED]> helo=<fhkbtu.com> from=<[EMAIL PROTECTED]> helo=<fhnxpq.com> from=<[EMAIL PROTECTED]> helo=<fhnxpq.com> from=<[EMAIL PROTECTED]> helo=<fhpdmj.com> from=<[EMAIL PROTECTED]> helo=<fhpdmj.com> from=<[EMAIL PROTECTED]> helo=<fhqdex.com>
So if you are using the DNS validation techniques of:
1. require "valid" helo hostname (passes, no illegal characters)
2. require "fully qualified" helo hostname (passes, as domain.tld)
3. require "known" helo hostname (ie, DNS findable) ( now passes, as random junk)
... as a direct result of Verisign's rape of DNS, in their conflicting roles as $$registrar and as registry/gTLDservers.net server operator (for which operation you are already required to pay Versign $6 annually for every .com or .net domain you rent).
Also note: if you are rejecting msgs where envelope @sender.domain is not DNS-findable (also a very reliable test), then those DNS validations are also nullified by Verisign's DNS rape.
I doubt MS will do anything to help your MS DNS servers, since this kind of venal abuse of monopoly power is fully consistent with MS's long, irrefutable, litigated-and-lost history.
but ...
ISC.org has in the last several hours announced patches to 3 versions of BIND9 (nothing for BIND8, afaics) with a new zone type called "delegation-only" that is configured simply:
zone "com" { type delegation-only; };
zone "net" { type delegation-only; };
.com and .net being the two gTLD zones run by Verisign.
In operation, this new zone type means that the only DNS query responses accepted by BIND9 as valid from servers authoritative for .com and .net (ie, Verisign's servers are the zone masters) are delegation data (ie, NS records) and their corresponding "glue" records (ie, A records) for registered hosts (ie, DNS servers)).
All other responses receieved by BIND9, ie, Verisign's fake A records taking your to their website returned for all <junk>.net or <junk>.com domains, are effectively seen as NXDOMAIN or NODATA, meaning the domain queried for does not exist in the TLD server and your "reject if HELO ( @sender.domain not found" becomes effective again. :))
btw, apparently the registrars/registry operators for other .TLDs have been raping their DNS for months, so you can nullify their TLD shenanigans also by the declaring all of them as "zone type delegation-only". In fact, I can't see why you should not set up ALL .TLDs as delegation-only.
Len
_____________________________________________________________________ http://MenAndMice.com/DNS-training: San Jose; Wash DC; Dallas; Atlanta IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
