* Matus UHLAR - fantomas <uh...@fantomas.sk>: > >* Marc Perkel <supp...@junkemailfilter.com>: > >>Just sharing some ideas on blocking outbound spam. > > On 20.08.11 21:55, Patrick Ben Koetter wrote: > >- We require humans to use submission instead of smtp > > How do you (want to) enforce this? Or is it just contractual requirement?
It is a contractual requirement enforced by technical architecture. We use Postfix and its postscreen daemon. The daemon uses blacklists do decide it it wants to hand down the client connection to the Postfix SMTP server smtpd. This is very efficient to fight incoming spam, but the way it works it also kills MUAs from (blacklisted) dial-up networks. The solution is to route local senders to submission and not have the postscreen daemon monitor that port. Customers adopt that once they find out it works flawlessly AND the receive less spam. We benefit from it having all local senders on a special port where we can run special SMTP and content policies. > >- German laws forbid looking at content without local senders consent. > > does this apply for virus filtering too? Nope. In context of virii the organizational interest to protect the organization overrule personal interests. > >When we look at the SMTP session we MUST NOT log anything that leads back to > >the real person or lets us track the person down. If we log we use hashes to > >destroy a trackable connection. > > I thought that the EU requires providers to log the sender and > recipient... so you log their hashes instead of e-mail addresses? DISCLAIMER: I AM NOT A LAWYER. THIS IS NOT LEGAL ADVICE. So don't sue me for talking about laws without being a lawyer ... To my knowledge the whole field of data retention is a moving target. IIRC ISPs are required to keep log data for a given period, but they must not keep deep traces without reason. Reason would be a federal inquiry that orders you to log everything from the connection until disconnect. In general, in Germany, we must not collect any data unless there is a reason. If we start collecting data for statistics we break that principle. To get around that we destroy the backward link to an identity p@rick -- state of mind () Digitale Kommunikation http://www.state-of-mind.de Franziskanerstraße 15 Telefon +49 89 3090 4664 81669 München Telefax +49 89 3090 4666 Amtsgericht München Partnerschaftsregister PR 563
