53% of Postfix servers are black-listed (DNSBL)

2015-12-29 Thread sb
90% of global e-mail is SPAM. 91% of targeted attacks start with e-mail. What is Postfix's share of SPAM? A recent survey of 2.8M SMTP servers shows the following. - 53% of Postfix servers are black-listed (DNSBL) http://www.mailradar.com/mailstat/mta/Postfix

Re: Example of postfix's pcre \A \z /A false positive

2015-12-26 Thread sb
The OP includes information that you clearly ignored. If you step out of Postfix for a moment, and read the OP again, then you cannot fail to see a Perl Compatible Regular Expression that works exactly as intended on the e-mail body when saved as a file. From the same standpoint, you cannot fa

Re: Example of postfix's pcre \A \z /A false positive

2015-12-23 Thread sb
Re: body_checks(5) > The input string for body_checks is a single message body line. > so "\A" == "^" and "\z" == "$". Both /m and /A are compliant with postfix's pcre_table(5). Therefore, \A and \z *must not* fall back to ^ and $ when using /Am. Postfix's adaptation of pcre leads to false posi

Example of postfix's pcre \A \z /A false positive

2015-12-22 Thread sb
Let test.eml be a complete e-mail, and let test-body.eml be the body of test.eml only. The following matches any e-mail body with a single link surrounded by spaces and newlines: perl -n0e '/\A\s*]+\s*\z/mi and print' test-body.eml Therefore, we add the following to postfix's body_checks: /\A

Re: reject connections from hosts without mx record

2015-12-14 Thread sb
This is the reply to a person who wanted to stay anonymous. I am posting the reply here, with his name bleached, because it may help similar readers. On 12/14/15 4:42 PM, R.H. (privat) wrote: >http://marc.info/?l=postfix-users&m=144978027304340&w=2 >> Run a "proper" e-mail server, that is,

Re: reject connections from hosts without mx record

2015-12-10 Thread sb
On 12/10/15 5:19 PM, Viktor Dukhovni wrote: On Thu, Dec 10, 2015 at 01:10:52PM +0100, sb wrote: We must find a way to reject telnet-like cloud-based e-mails. A little knowledge is a dangerous thing. You've convinced yourself that you thoroughly understand more than you do, and have b

Re: DANE statistics

2015-12-10 Thread sb
I look forward to read the stats from https://dane.sys4.de/ On 12/10/15 3:29 PM, Dirk Stöcker wrote: Hello, does anyone here have statistics about DANE enabled mail servers? And maybe also a timeline showing an increase (hopefully)? I'm running DANE for some time now and I don't ever get a

Re: reject connections from hosts without mx record

2015-12-10 Thread sb
e-mail from that pool is good enoughto cause damages while hiding its identity from the forensics. We must find a way to reject telnet-like cloud-based e-mails. SB

Re: reject connections from hosts without mx record

2015-12-09 Thread sb
On 12/7/15 7:19 PM, Wietse Venema wrote: Wietse Venema: sb: Our point of view is plain: are we dealing with "proper" e-mail servers? Good question. Our emphasis, therefore, is on the DNS, to identify the sender and its MX RR, because it is the de-facto standard to say "

Re: reject connections from hosts without mx record

2015-12-07 Thread sb
Everybody, Thank you for your clarifications on postfix terms, I will treasure it, but let us focus on the problem please. Legal procedures allow us to take down identified e-mail servers. It is not possible, however, to proceed against a botnet of static and dynamic addresses that send e-mail

Re: reject connections from hosts without mx record

2015-12-06 Thread sb
On 12/5/15 11:28 PM, Noel Jones wrote: >>This is the spamming host: >> >> >unbound-host -rvD 78-134-2-123.v4.ngi.it >>78-134-2-123.v4.ngi.it has address 78.134.2.123 (insecure) >>78-134-2-123.v4.ngi.it has no IPv6 address (insecure) >>78-134-2-123.v4.ngi.it has no mail handler record (insecure)

Re: reject connections from hosts without mx record

2015-12-05 Thread sb
On 12/4/15 9:39 PM, Noel Jones wrote: Is this even the IP the sender domain pointed to? That isn't clear in your posting. Answered 4h earlier, althoughthe particular case of 78-134-2-123.v4.ngi.it was just a conversation starter. On 12/4/15 6:28 PM, sb wrote: This is the spamming

Re: reject connections from hosts without mx record

2015-12-04 Thread sb
On 12/4/15 7:08 PM, Noel Jones wrote: > The sender domain must have either an MX or an A record. > You can reply to a domain with only an A record. If I send mail to the above address, there is no server that can receive it: > telnet 78.134.2.123 25 Trying 78.134.2.123... No response given. Th

reject connections from hosts without mx record

2015-12-04 Thread sb
Hello, I received (yet another) SPAM/UCE from an address without MX record. Although it is not mandatory for a sender to have an MX record, this RFC loophole is exploited by spammers. Further, I do not want to receive mail from someone I cannot reply to. Before writing a milter, I would need to