Re: [mailop] Invalid address ratio?

[Chris]

On Fri, 2 Feb 2018 20:29:29 +
Michael Wise via mailop wrote:

> Anything more than 5% bad recipients in mail sent by a given IP
> address will land you in hot water with ... certain ISPs. 

Good idea. Maybe I should collect them. But as John wrote, they're
probably already on the black lists.

- Chris

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Benjamin BILLON]

> Yes, inbound. I'm wondering why there are so many mails to not-existing 
> recipients.
...
> Anything more than 5% bad recipients in mail sent by a given IP address will 
> land you in hot water with ... certain ISPs. 

Here's the explanation I give when I have to explain why high hard bounce rate 
= bad: once upon a time, spammers thought that maybe they'll manage to reach an 
existing email address if they tried to contact every combination of accepted 
characters in the user part of email addresses. Starting with a@, aa@, aaa@ to 
z@, with numbers or without. At some point they thought that 
using a dictionary of firstnames and/or lastnames could spare some time, as a 
lot of email addresses are built this way.
That was spam.
That generated a lot of hard bounces.
Receivers started to consider that lot of hard bounces = spam.


--
Benjamin

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Michael Wise via 
mailop
Sent: Saturday, 3 February, 2018 04:29
To: ComKal Networks ; mailop@mailop.org
Subject: Re: [mailop] Invalid address ratio?




Anything more than 5% bad recipients in mail sent by a given IP address will 
land you in hot water with ... certain ISPs. 

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?



-Original Message-
From: mailop > On 
Behalf Of ComKal Networks
Sent: Friday, February 2, 2018 9:02 AM
To: mailop@mailop.org
Subject: Re: [mailop] Invalid address ratio?



> I'm a bit surprised, that on a small mail server, 77 % of the rejected

> mails are rejected because of invalid recipient adresses. 22 % because

> of DNSBL.



> Is this ratio normal?



There abouts, email is free, for a certain class, so adding a lot of names to 
the left of the @ is very old school but also a lot of the scrappers end up 
with all those weird usernames like 
4ffb8ac-a0a-3cc0-e87c-65a3df124...@example.net

that appear in email headers as part of references in mailing lists etc.



The ratio does vary depending on age and usage a domain has had so I'm serious 
when I say it could vary as much as +10 -50%.







___

mailop mailing list

mailop@mailop.org

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop=02%7C01%7Cmichael.wise%40microsoft.com%7Cffc6c6cc14b5457f9bab08d56a5f8aa8%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636531880955379727=bKGga8FuHuTWEXSkkYnAvJ%2BHhCuAfMrlXyh7OEdzDTM%3D=0
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Trulia / Zillow contact

[Benjamin BILLON]

@Jaren, what action do you expect an ESP to take when their domain is being 
abused?

--
Benjamin

From: mailop [mailto:mailop-boun...@mailop.org] On Behalf Of Will Boyd via 
mailop
Sent: Saturday, 3 February, 2018 05:33
To: Jaren Angerbauer 
Cc: mailop 
Subject: Re: [mailop] Trulia / Zillow contact

I just came to the same conclusion as Steve. I don't work with that mailstream 
or domain, but I do work a bit with some folks at Zillow. I'm responding 
offline to Jaren.

Will

On Fri, Feb 2, 2018 at 2:26 PM, Steve Atkins 
> wrote:

> On Feb 2, 2018, at 12:22 PM, Jaren Angerbauer 
> > wrote:
>
> Hi,
>
> Looking for a contact Zillow, or even possibly their ESP.

That'd be mailgun, for this domain anyway, for anyone following along at home.

>  We are seeing one of their domains 
> (email.zillow-mail.com) being abused by 
> affiliate spammers.

Cheers,
  Steve


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop



--
[sendgridlogo2.png]
Will Boyd
Email Deliverability Consultant
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Michael Wise via mailop]

For, “smaller players” the best way is to submit the traffic thru SpamCop.

We get a feed from them, and it’s one more drop in the bucket … but the buckets 
are looked at by a human.

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?



-Original Message-
From: mailop  On Behalf Of Rob Kendrick
Sent: Friday, February 2, 2018 3:53 PM
To: mailop@mailop.org
Subject: Re: [mailop] Lots of spam from gmail ?



On Fri, Feb 02, 2018 at 05:20:14PM -0500, John Levine wrote:

> In the past few days I've seen a lot of spam from gmail, sleazy SEO

> and the like.  Has someone cracked their signup system?



About 20% of the UCE and spam that reaches my customers' INBOXES is from 
outlook.com or gmail.com.  Obviously reporting it is a waste of time as they're 
both brick walls to smaller players.



B.



___

mailop mailing list

mailop@mailop.org

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop=02%7C01%7Cmichael.wise%40microsoft.com%7C368773766a394a467dbe08d56a9926e5%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636532128373107529=AnCAMSdbrFIc5KeEd7iT%2BIx7naDx4cBptv8VAIWre1I%3D=0
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Rob Kendrick]

On Fri, Feb 02, 2018 at 05:20:14PM -0500, John Levine wrote:
> In the past few days I've seen a lot of spam from gmail, sleazy SEO
> and the like.  Has someone cracked their signup system?

About 20% of the UCE and spam that reaches my customers' INBOXES is from
outlook.com or gmail.com.  Obviously reporting it is a waste of time as
they're both brick walls to smaller players.

B.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Michael Peddemors]

On 18-02-02 02:20 PM, John Levine wrote:

In the past few days I've seen a lot of spam from gmail, sleazy SEO
and the like.  Has someone cracked their signup system?


Our filtering team always seems to be chasing those SEO ones down..
Been a problem for months now.. Our personal belief is that Google 
outbound filters treat 'Google SEO' and similar 'top ten on google' with 
a positive bias ;)




--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Brett Schenker]

I've been getting that for quite some time too. At least three months. It
seems to have ramped up in the last three weeks.

Brett

On Fri, Feb 2, 2018 at 5:30 PM, Aaron C. de Bruyn via mailop <
mailop@mailop.org> wrote:

> It's been about a month for me, but my GSuite account has been
> hammered from other GSuite or Gmail accounts and it's all a mix of SEO spam
> and "Hire us for your business website" junk.  Most of it gets filtered,
> but a few per day get into my inbox.
>
> -A
>
>
> On Fri, Feb 2, 2018 at 2:22 PM John Levine  wrote:
>
>> In the past few days I've seen a lot of spam from gmail, sleazy SEO
>> and the like.  Has someone cracked their signup system?
>>
>>
>>
>>
>> ___
>> mailop mailing list
>> mailop@mailop.org
>> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
>


-- 
Brett Schenker
Man of Many Things, Including
5B Consulting - http://www.5bconsulting.com
Graphic Policy - http://www.graphicpolicy.com

Twitter - http://twitter.com/bhschenker
LinkedIn - http://www.linkedin.com/in/brettschenker
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Steve Atkins]

> On Feb 2, 2018, at 2:30 PM, Aaron C. de Bruyn via mailop  
> wrote:
> 
> It's been about a month for me, but my GSuite account has been hammered from 
> other GSuite or Gmail accounts and it's all a mix of SEO spam and "Hire us 
> for your business website" junk.  Most of it gets filtered, but a few per day 
> get into my inbox.

There's been a steady stream of B2B spam out of there for ages (partly due to 
the lead gen spam outfits whose business model is "give us the keys to your 
google apps account"). No noticeable increase recently, though.

Cheers,
  Steve


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Lots of spam from gmail ?

[Aaron C. de Bruyn via mailop]

It's been about a month for me, but my GSuite account has been
hammered from other GSuite or Gmail accounts and it's all a mix of SEO spam
and "Hire us for your business website" junk.  Most of it gets filtered,
but a few per day get into my inbox.

-A


On Fri, Feb 2, 2018 at 2:22 PM John Levine  wrote:

> In the past few days I've seen a lot of spam from gmail, sleazy SEO
> and the like.  Has someone cracked their signup system?
>
>
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[John Levine]

In article <20180202172637.30063632@cd>, Chris   wrote:
>I'm a bit surprised, that on a small mail server, 77 % of the rejected
>mails are rejected because of invalid recipient adresses. 22 % because
>of DNSBL.
>
>Is this ratio normal?

As others have said, in the world of e-mail, anything can be normal or
abnormal.

On a few of the domains I host, notably telecom-digest.org, about
99.99% of the mail is spam to bogus addresses.  You can easily
recognize them as old message-IDs, harvested from usenet long ago by
broken scrapeware.  If you have old domains without a lot of real
users, a lot of bogus addresses would have accreted onto spam lists
through a combination of broken scrapeware using message IDs and
truncated addresses along with typos and ancient dictionary attacks.

I would also be fairly confident that if you did the DNSBL checks
first, you'd find that pretty much all of them were caught by the
DNSBLs.

R's,
John


-- 
Regards,
John Levine, jo...@iecc.com, Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Heads Up

[Michelle Sullivan]

Ken O'Driscoll via mailop wrote:

On Sat, 2018-01-20 at 11:14 +1100, Michelle Sullivan wrote:

One can only conclude, they either have a leak in their API, or they
altered the permissions to give out emails when specifically denied, or
they got hacked and didn't disclose it.

They had bug for over a year between ~2012-2013 where contact details
(including email) were unintentionally exposed.

More info: 
https://www.reuters.com/article/net-us-facebook-security/facebook-admits-year-long-data-breach-exposed-6-million-users-idUSBRE95K18Y20130621

So, you could have been part of that.


Possibly.


In any event, I'd let their security team know what happened.

You could also check (if you haven't already) haveibeenpwned.com to see if
the address pops up in any breach.


Yeah I don't do that in case the lookups are compromised... :)

--
Michelle Sullivan
http://www.mhix.org/


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Lots of spam from gmail ?

[John Levine]

In the past few days I've seen a lot of spam from gmail, sleazy SEO
and the like.  Has someone cracked their signup system?




___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Heads Up

[Michelle Sullivan]

Charles McKean wrote:

On Sat, Jan 20, 2018 at 9:41 AM, Ken O'Driscoll via mailop
 wrote:

On Sat, 2018-01-20 at 11:14 +1100, Michelle Sullivan wrote:

One can only conclude, they either have a leak in their API, or they
altered the permissions to give out emails when specifically denied, or
they got hacked and didn't disclose it.

They had bug for over a year between ~2012-2013 where contact details
(including email) were unintentionally exposed.

Can't your friends see your email address on Facebook? Wouldn't that
mean that literally anybody could be responsible for leaking this
address?



No certain details (like email address) are 'Only Me' permission on my 
Facebook - because it (the email) is only used for Facebook login.


Regards,

--
Michelle Sullivan
http://www.mhix.org/


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Trulia / Zillow contact

[Will Boyd via mailop]

I just came to the same conclusion as Steve. I don't work with that
mailstream or domain, but I do work a bit with some folks at Zillow. I'm
responding offline to Jaren.

Will

On Fri, Feb 2, 2018 at 2:26 PM, Steve Atkins  wrote:

>
> > On Feb 2, 2018, at 12:22 PM, Jaren Angerbauer 
> wrote:
> >
> > Hi,
> >
> > Looking for a contact Zillow, or even possibly their ESP.
>
> That'd be mailgun, for this domain anyway, for anyone following along at
> home.
>
> >  We are seeing one of their domains (email.zillow-mail.com) being
> abused by affiliate spammers.
>
> Cheers,
>   Steve
>
>
> ___
> mailop mailing list
> mailop@mailop.org
> https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
>



-- 
[image: sendgridlogo2.png] 
Will Boyd
Email Deliverability Consultant
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Trulia / Zillow contact

[Steve Atkins]

> On Feb 2, 2018, at 12:22 PM, Jaren Angerbauer  
> wrote:
> 
> Hi,
> 
> Looking for a contact Zillow, or even possibly their ESP.

That'd be mailgun, for this domain anyway, for anyone following along at home.

>  We are seeing one of their domains (email.zillow-mail.com) being abused by 
> affiliate spammers.

Cheers,
  Steve


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Michael Peddemors]

Speaking of which.. (can you tell it is Friday, everyone has time to be 
helpful)...


Our Spam Auditors noticed a fairly new 'email verification' network, at 
least the IP range.. majority of the 31.129.32.0 - 31.129.63.255 network 
used, and triggering various rate limiters..


Coming out of the Ukraine..

Someone is probably washing an old list using that 'service'.

#31.129.33.22  1   qzzqwwazrpi.my-addr.com
#31.129.33.163 1   aewqwwazrpi.my-addr.com

That is the naming pattern..

That kind of large scale process can throw your invalid recip logs a 
loop pretty quick.. and skew your stats..


Course, it is probably better than the list washing services using 
Amazon IP space.. at least they clearly identify what they do..





On 18-02-02 12:29 PM, Michael Wise via mailop wrote:
Anything more than 5% bad recipients in mail sent by a given IP address 
will land you in hot water with ... certain ISPs. 


Aloha,

Michael.

--

*Michael J Wise*
MicrosoftCorporation| Spam Analysis

"Your Spam Specimen Has Been Processed."

Got the Junk Mail Reporting Tool 
?


-Original Message-
From: mailop  On Behalf Of ComKal Networks
Sent: Friday, February 2, 2018 9:02 AM
To: mailop@mailop.org
Subject: Re: [mailop] Invalid address ratio?

 > I'm a bit surprised, that on a small mail server, 77 % of the rejected

 > mails are rejected because of invalid recipient adresses. 22 % because

 > of DNSBL.

 > Is this ratio normal?

There abouts, email is free, for a certain class, so adding a lot of 
names to the left of the @ is very old school but also a lot of the 
scrappers end up with all those weird usernames like 
4ffb8ac-a0a-3cc0-e87c-65a3df124...@example.net 



that appear in email headers as part of references in mailing lists etc.

The ratio does vary depending on age and usage a domain has had so I'm 
serious when I say it could vary as much as +10 -50%.


___

mailop mailing list

mailop@mailop.org 

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop=02%7C01%7Cmichael.wise%40microsoft.com%7Cffc6c6cc14b5457f9bab08d56a5f8aa8%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636531880955379727=bKGga8FuHuTWEXSkkYnAvJ%2BHhCuAfMrlXyh7OEdzDTM%3D=0



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Michael Wise via mailop]

Anything more than 5% bad recipients in mail sent by a given IP address will 
land you in hot water with ... certain ISPs. 

Aloha,
Michael.
--
Michael J Wise
Microsoft Corporation| Spam Analysis
"Your Spam Specimen Has Been Processed."
Got the Junk Mail Reporting 
Tool ?



-Original Message-
From: mailop  On Behalf Of ComKal Networks
Sent: Friday, February 2, 2018 9:02 AM
To: mailop@mailop.org
Subject: Re: [mailop] Invalid address ratio?



> I'm a bit surprised, that on a small mail server, 77 % of the rejected

> mails are rejected because of invalid recipient adresses. 22 % because

> of DNSBL.



> Is this ratio normal?



There abouts, email is free, for a certain class, so adding a lot of names to 
the left of the @ is very old school but also a lot of the scrappers end up 
with all those weird usernames like 
4ffb8ac-a0a-3cc0-e87c-65a3df124...@example.net

that appear in email headers as part of references in mailing lists etc.



The ratio does vary depending on age and usage a domain has had so I'm serious 
when I say it could vary as much as +10 -50%.







___

mailop mailing list

mailop@mailop.org

https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fchilli.nosignal.org%2Fcgi-bin%2Fmailman%2Flistinfo%2Fmailop=02%7C01%7Cmichael.wise%40microsoft.com%7Cffc6c6cc14b5457f9bab08d56a5f8aa8%7Cee3303d7fb734b0c8589bcd847f1c277%7C1%7C1%7C636531880955379727=bKGga8FuHuTWEXSkkYnAvJ%2BHhCuAfMrlXyh7OEdzDTM%3D=0
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Trulia / Zillow contact

[Jaren Angerbauer]

Hi,

Looking for a contact Zillow, or even possibly their ESP.  We are seeing
one of their domains (email.zillow-mail.com) being abused by affiliate
spammers.

Thanks,

--Jaren
___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Chris]

On Fri, 2 Feb 2018 08:50:01 -0800
Michael Peddemors wrote:

> Invalid users should be less than 10% typically, if good bot net 
> protection in place before the RCPT TO stage..

Recipient verification is one of the first tests. Maybe I should enable
postscreen. Is this sufficient for bots?
 
> And simple 'Best Practices' policies and spam rules should get about
> 50% of the rest.. before handing it off to advanced content
> filtering..

Yes, DNSBL are getting a lot more than the content filter afterwards.

> Without full bot protection, RBL's and rate limiters BEFORE RCPT TO,
> you can expect MUCH higher rates..

Ok, I'll have a look again at rate limiters. They're enabled, but could
probably filter more.
 
- Chris

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Chris]

On Fri, 02 Feb 2018 16:52:16 +
Ken O'Driscoll via mailop wrote:

> On Fri, 2018-02-02 at 17:26 +0100, Chris wrote:
> > I'm a bit surprised, that on a small mail server, 77 % of the
> > rejected mails are rejected because of invalid recipient adresses.
> > 22 % because of DNSBL.
> > 
> > Is this ratio normal?  
> 
> Assuming you're talking about inbound emails and wondering why more
> mails aren't being caught by RBLs.

Yes, inbound. I'm wondering why there are so many mails to
not-existing recipients.

> It depends on the domains hosted on the box (age and overall
> exposure), what RBLs you employ and, crucially, the order in which
> your MTA processes things - i.e. does the address check occur before
> the RBL tests etc.

Yes, address check is before RBL. The domain is probably in use since
1998. RBL is mostly spamhaus.


- Chris

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[ComKal Networks]

> I'm a bit surprised, that on a small mail server, 77 % of the rejected
> mails are rejected because of invalid recipient adresses. 22 % because
> of DNSBL.

> Is this ratio normal?

There abouts, email is free, for a certain class, so adding a lot
of names to the left of the @ is very old school but also
a lot of the scrappers end up with all those weird usernames
like 4ffb8ac-a0a-3cc0-e87c-65a3df124...@example.net
that appear in email headers as part of references in mailing
lists etc.

The ratio does vary depending on age and usage a domain
has had so I'm serious when I say it could vary as much
as +10 -50%.



___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Ken O'Driscoll via mailop]

On Fri, 2018-02-02 at 17:26 +0100, Chris wrote:
> I'm a bit surprised, that on a small mail server, 77 % of the rejected
> mails are rejected because of invalid recipient adresses. 22 % because
> of DNSBL.
> 
> Is this ratio normal?

Assuming you're talking about inbound emails and wondering why more mails
aren't being caught by RBLs.

It depends on the domains hosted on the box (age and overall exposure),
what RBLs you employ and, crucially, the order in which your MTA processes
things - i.e. does the address check occur before the RBL tests etc.

If you could provide more details, I'm sure the answers will be more
specific.

Ken.


-- 
Ken O'Driscoll / We Monitor Email
t: +353 1 254 9400 | w: www.wemonitoremail.com

Need to understand deliverability? Now there's a book:
www.wemonitoremail.com/book


___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

Re: [mailop] Invalid address ratio?

[Michael Peddemors]

That is REALLY hard to gauge..

While lots of rejected email addresses is expected behavior..
 * Spammers using old lists
 * Dictionary Attacks
 * Email Address verification Systems

It REALLY depends how your system is configured, what RBL's you are 
using, what is the email platform, do you employ rate limiters..


All of these factors affect percentages..

And it can change from day to day, week to week..
depending on the BOT activity at that time..

For instance, in todays stats.. we see a higher than normal rate of 
early detection (botnet activity) which results in the stats showing 
98.4% of all email detected as spam (pre-filter).


Typically, DUL style RBL's and standard RBL's should be picking up at 
least 50% (a lot more if you don't have good inbound rate limiters)


More sensitive or special purpose RBL's can detect from 40-60% of what 
gets past those..


Invalid users should be less than 10% typically, if good bot net 
protection in place before the RCPT TO stage..


And simple 'Best Practices' policies and spam rules should get about 50% 
of the rest.. before handing it off to advanced content filtering..


Without full bot protection, RBL's and rate limiters BEFORE RCPT TO, you 
can expect MUCH higher rates..


Also, the stats will greatly vary, based on the number of domains whose 
MX points to your server.  A server with only one domain will have a lot 
different stats than one with thousands of domains, even if they have an 
equal number of email addresses.




On 18-02-02 08:26 AM, Chris wrote:

All,

I'm a bit surprised, that on a small mail server, 77 % of the rejected
mails are rejected because of invalid recipient adresses. 22 % because
of DNSBL.

Is this ratio normal?

Thank you in advance.

- Chris

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop





--
"Catch the Magic of Linux..."

Michael Peddemors, President/CEO LinuxMagic Inc.
Visit us at http://www.linuxmagic.com @linuxmagic

A Wizard IT Company - For More Info http://www.wizard.ca
"LinuxMagic" a Registered TradeMark of Wizard Tower TechnoServices Ltd.

604-682-0300 Beautiful British Columbia, Canada

This email and any electronic data contained are confidential and intended
solely for the use of the individual or entity to which they are addressed.
Please note that any views or opinions presented in this email are solely
those of the author and are not intended to represent those of the company.

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop

[mailop] Invalid address ratio?

[Chris]

All,

I'm a bit surprised, that on a small mail server, 77 % of the rejected
mails are rejected because of invalid recipient adresses. 22 % because
of DNSBL.

Is this ratio normal?

Thank you in advance.

- Chris

___
mailop mailing list
mailop@mailop.org
https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop