Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-25 Thread Markus Stumpf
On Tue, Jan 25, 2005 at 01:09:04PM +0530, Suresh Ramasubramanian wrote: On Mon, 24 Jan 2005 22:29:49 +0100, Markus Stumpf [EMAIL PROTECTED] wrote: If you look at your logfiles you will notice that 95% of all legit mailservers already have working and individual revDNS. I'll just point

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-25 Thread Valdis . Kletnieks
On Tue, 25 Jan 2005 09:43:06 PST, J.D. Falk said: (I'm also surprised you need 300 servers to handle such a small load -- what is that, ~ messages per server per day?) Some mail software scales better than others. ;) And yes, we *DID* have one large software vendor admit that

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-25 Thread Markus Stumpf
On Tue, Jan 25, 2005 at 12:22:33PM -0500, [EMAIL PROTECTED] wrote: Which would mean that if Suresh insisted on revDNS, he'd end up blocking only 2 hosts, but 40% of his legitimate mail would be dropped on the floor. Correct. But neither MTAMARK nor I suggest blocking based on non existant

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-25 Thread Valdis . Kletnieks
On Tue, 25 Jan 2005 18:03:02 +0100, Markus Stumpf said: How did you calculate that 40% of my legitimate email? If you get 60 emails from 60 different hosts that have revDNS and you get 40 mails from two hosts without revDNS then also 40% of your legitimate email is coming from servers without

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-25 Thread Suresh Ramasubramanian
On Tue, 25 Jan 2005 18:03:02 +0100, Markus Stumpf [EMAIL PROTECTED] wrote: I'll just point out that you are generalizing based on a case you see in your mailserver I am generalizing on what I see from about 300 mailservers and about 1 million messages a day. You should see the trends I

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-24 Thread Markus Stumpf
(sorry, first reply to list lost due to wrong From) In priciple, nothing. In practice, the rDNS is a mess and I don't know many people who think it's likely to get cleaned up enough that we can expect to put in all the MTA MARK entries. If you look at your logfiles you will notice that 95%

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-24 Thread Suresh Ramasubramanian
On Mon, 24 Jan 2005 22:29:49 +0100, Markus Stumpf [EMAIL PROTECTED] wrote: If you look at your logfiles you will notice that 95% of all legit mailservers already have working and individual revDNS. About the rest of the post - others have commented on MTAMARK .. I'll just point out that you

Re: marking dynamic ranges, was fixing insecure email infrastructure

2005-01-13 Thread John Levine
What is wrong with MTAMARK? MTAMARK tags the reverse entries of IP addresses where SMTP servers are. Fixes this problem very fast, efficient and with little effort (script magic to regenerate the reverse DNS entries). In priciple, nothing. In practice, the rDNS is a mess and I don't know