Comments on: Reducing Spam to Nearly Zero with PTR Record Filtering http://mostlygeek.com/tech/ptr-spam-filtering/?utm_source=rss&utm_medium=rss&utm_campaign=rss Smothered in Awesome Sauce! Tue, 03 Jan 2012 06:09:19 +0000 hourly 1 http://wordpress.org/?v=3.2.1 By: Mark W. Prasek http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-24140 Mark W. Prasek Wed, 04 Nov 2009 23:02:09 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-24140 Interesting dialog. I have written my own software that could implement the technique if you choose, but I have not found it not necessary. I have virtually eliminated all spam from even getting to my mail server. I'm presently blocking over 99% of all incoming connections and false positives have been very manageable. <a href="http://www.spamdike.com" rel="nofollow"> www.SpamDike.com</a> Interesting dialog. I have written my own software that could implement the technique if you choose, but I have not found it not necessary. I have virtually eliminated all spam from even getting to my mail server. I’m presently blocking over 99% of all incoming connections and false positives have been very manageable. http://www.SpamDike.com

]]> By: Benson Wong http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-24139 Benson Wong Wed, 04 Nov 2009 22:46:48 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-24139 Harold, Using PTR filtering as part of a multi-phase solution is actually quite effective. It depends though. It is rare that a valid email address would come from a dial up or home ISP connection from a foreign country for us. So part of the solution would be to scrutinize these emails more, rather than dropping them completely. The big ISPs (Shaw, Telus) here blocking outgoing port 25. This has pretty much killed the amount of spam coming from zombied machines on home ISPs. I think it is inexcusable for an ISP (regardless of size) to not know how to set up a PTR record for their mail systems. Harold,

Using PTR filtering as part of a multi-phase solution is actually quite effective. It depends though.

It is rare that a valid email address would come from a dial up or home ISP connection from a foreign country for us. So part of the solution would be to scrutinize these emails more, rather than dropping them completely.

The big ISPs (Shaw, Telus) here blocking outgoing port 25. This has pretty much killed the amount of spam coming from zombied machines on home ISPs.

I think it is inexcusable for an ISP (regardless of size) to not know how to set up a PTR record for their mail systems.

]]> By: Harold Poley http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-24138 Harold Poley Wed, 04 Nov 2009 22:14:27 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-24138 This is not really a valid anti-spam technique since since you catch too much valid email with the spam. Small businesses rely on their ISPs to set up the reverse DNS pointers correctly, and few ISPs have the technical chops to pull this off. If you doubt this, just call your ISP and ask them to configure the reverse DNS for your domain name and their IP address. As them to set up more than one for any given IP, and they'll generally refuse. Add to that the fact that many Mom and Pops work out of their homes using dynamic IPs and you have a real user nightmare. This technique reduces spam because it blocks ALL email from non-matched sources. Just because the majority of email happens to be spam, doesn't make it a legitimate methodology. It's like bombing Detroit to reduce its crime rate. Sure the crime is reduced when the city is a pile of rubble, but you've missed the point ... you've just made the city useless. This is not really a valid anti-spam technique since since you catch too much valid email with the spam. Small businesses rely on their ISPs to set up the reverse DNS pointers correctly, and few ISPs have the technical chops to pull this off. If you doubt this, just call your ISP and ask them to configure the reverse DNS for your domain name and their IP address. As them to set up more than one for any given IP, and they’ll generally refuse.

Add to that the fact that many Mom and Pops work out of their homes using dynamic IPs and you have a real user nightmare.

This technique reduces spam because it blocks ALL email from non-matched sources. Just because the majority of email happens to be spam, doesn’t make it a legitimate methodology. It’s like bombing Detroit to reduce its crime rate. Sure the crime is reduced when the city is a pile of rubble, but you’ve missed the point … you’ve just made the city useless.

]]> By: Mark W. Prasek http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-23924 Mark W. Prasek Fri, 10 Jul 2009 04:32:42 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-23924 I'm an ISP that cooked up my own home grown solution. There are some Techniques and Strategies on my website that may be of help I’m an ISP that cooked up my own home grown solution. There are some Techniques and Strategies on my website that may be of help

]]> By: Ben Wong http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-23601 Ben Wong Mon, 22 Sep 2008 06:40:15 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-23601 Since I wrote the entry I've stopped using PTR filtering. While it works out quite well it was way too much management work. I leave it to the Barracuda team and the DNS blackhole lists. While it doesn't catch as much of he spam, it is still quite effective. Since I wrote the entry I’ve stopped using PTR filtering. While it works out quite well it was way too much management work. I leave it to the Barracuda team and the DNS blackhole lists.

While it doesn’t catch as much of he spam, it is still quite effective.

]]> By: Tony http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-23600 Tony Mon, 22 Sep 2008 04:57:36 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-23600 While it may be the holy grail of spam filters it causes no end of trouble to little guys like me who have to explain to their ISP's help desk that setting up the PTR record is their job. While it may be the holy grail of spam filters it causes no end of trouble to little guys like me who have to explain to their ISP’s help desk that setting up the PTR record is their job.

]]> By: anti-SPAM | Memo to ISPs: The SPAM Problem is Partly Your Fault | IT Infusion | Calgary, Alberta http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-2981 anti-SPAM | Memo to ISPs: The SPAM Problem is Partly Your Fault | IT Infusion | Calgary, Alberta Sat, 10 Feb 2007 19:30:23 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-2981 [...] Just take a look at the filtering results when Ben Wong started filtering SPAM based on PTR records from the Shaw network! There is clearly a ton of SPAM originating from the Shaw network. Now, perhaps Shaw is monitoring outbound SMTP traffic from their consumer cable modem network and I just don’t know about it. There are certainly tools available to that would allow Shaw to keep invisible tabs on what is exiting their network. Or perhaps they aren’t. If they are, they clearly aren’t doing a very good job of dealing with it! [...] [...] Just take a look at the filtering results when Ben Wong started filtering SPAM based on PTR records from the Shaw network! There is clearly a ton of SPAM originating from the Shaw network. Now, perhaps Shaw is monitoring outbound SMTP traffic from their consumer cable modem network and I just don’t know about it. There are certainly tools available to that would allow Shaw to keep invisible tabs on what is exiting their network. Or perhaps they aren’t. If they are, they clearly aren’t doing a very good job of dealing with it! [...]

]]> By: Most Effective Header Filtering Rules | [MostlyGeek] Real Estate Technology Blog http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-2877 Most Effective Header Filtering Rules | [MostlyGeek] Real Estate Technology Blog Fri, 09 Feb 2007 08:39:07 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-2877 [...] Tonight I did some analysis on the effectiveness of PTR blocking and the results are interesting. I exported the spam messages blocked in the past 24 hours by our Barracuda and did an analysis of the most effective PTR blocking regular expressions. I wrote about PTR filtering here and this is follow up to how effective it has been. [...] [...] Tonight I did some analysis on the effectiveness of PTR blocking and the results are interesting. I exported the spam messages blocked in the past 24 hours by our Barracuda and did an analysis of the most effective PTR blocking regular expressions. I wrote about PTR filtering here and this is follow up to how effective it has been. [...]

]]> By: Relaying Email Through Your ISP With FreeBSD | [MostlyGeek] Real Estate Technology Blog http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-2720 Relaying Email Through Your ISP With FreeBSD | [MostlyGeek] Real Estate Technology Blog Wed, 07 Feb 2007 00:54:58 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-2720 [...] With the increase of blocking of spam from dynamic hosts, this is for the FreeBSD users who need to relay all email through their ISP. [...] [...] With the increase of blocking of spam from dynamic hosts, this is for the FreeBSD users who need to relay all email through their ISP. [...]

]]> By: anti-SPAM | PTR DNS records and SPAM Filtering | IT Infusion | Calgary, Alberta http://mostlygeek.com/tech/ptr-spam-filtering/comment-page-1/#comment-2627 anti-SPAM | PTR DNS records and SPAM Filtering | IT Infusion | Calgary, Alberta Mon, 05 Feb 2007 05:31:27 +0000 http://www.mostlygeek.com/2007/01/23/how-to-reduce-spam-by-50/#comment-2627 [...] PTR DNS records and SPAM Filtering Blocking spam is an arms race between spam detection and detection avoidance techniques. Lately spammers had the upper hand but the tide has turned with new PTR record blocking techniques. This is how implementing PTR record filtering has reduced our spam to nearly zero. Reducing Spam to Nearly Zero with PTR Record Filtering [...] [...] PTR DNS records and SPAM Filtering Blocking spam is an arms race between spam detection and detection avoidance techniques. Lately spammers had the upper hand but the tide has turned with new PTR record blocking techniques. This is how implementing PTR record filtering has reduced our spam to nearly zero. Reducing Spam to Nearly Zero with PTR Record Filtering [...]

]]>