Re: Fake MX

2010-12-20 Thread Michelle Konzack
Hello Toni Mueller, Am 2010-12-08 19:06:43, hacktest Du folgendes herunter: > I tried the high MX for some time, but in my experience, spammers > usually only hit the first two MXes. I do not have this experience. > So if you were using the high and > low MX, you should imho have no reasonable b

Re: Fake MX

2010-12-17 Thread Jon Trulson
On Wed, 8 Dec 2010, Matt wrote: Anyone using the Fake MX trick? http://www.webhostingtalk.com/wiki/Fake_MX Is it safe to use a fake high and low mx? At my last company, I found it very useful to setup the high MX's to use a greylist. I would not use a low MX for this. It was very ef

Re: Fake MX

2010-12-13 Thread Martes G Wigglesworth
On 12/08/2010 03:34 PM, Chris Owen wrote: he other thing we see that always amazes me is that if we have MXs that are all the same weight, the ones that have the lowest reverse DNS host name get hit higher. I really have no idea how much less why this happens. It is sort of frustrating tho

RE: Fake MX

2010-12-13 Thread Rosenbaum, Larry M.
> From: Bob Proulx [mailto:b...@proulx.com] > Subject: Re: Fake MX > > > > [...] but that is distinct from being a tarpit, which is what > > > I'm trying to clarify. > > > > A discussion around the definition of tarpit, and why tarbaby might be a >

Re: Fake MX

2010-12-10 Thread Bob Proulx
> > [...] but that is distinct from being a tarpit, which is what > > I'm trying to clarify. > > A discussion around the definition of tarpit, and why tarbaby might be a > suboptimal, though catchy, name? For the record a "tarbaby": http://en.wikipedia.org/wiki/Tar_baby is something differen

Re: Fake MX

2010-12-10 Thread Karsten Bräckelmann
On Fri, 2010-12-10 at 09:13 -0800, John Hardin wrote: > On Fri, 10 Dec 2010, Marc Perkel wrote: > [...] but that is distinct from being a tarpit, which is what > I'm trying to clarify. > > Karsten, is this OT enough to be squelched? A discussion around the definition of tarpit, and why tarbaby

Re: Fake MX

2010-12-10 Thread John Hardin
On Fri, 10 Dec 2010, Marc Perkel wrote: On 12/8/2010 6:26 PM, John Hardin wrote: On Wed, 8 Dec 2010, Marc Perkel wrote: > Hitting the tarbaby server by itself doesn't get you listed. I have > ways of detecting spambots only. "tarbaby" has a very different connotation: that it is a TCP o

Re: Fake MX

2010-12-10 Thread Marc Perkel
On 12/8/2010 6:26 PM, John Hardin wrote: On Wed, 8 Dec 2010, Marc Perkel wrote: Hitting the tarbaby server by itself doesn't get you listed. I have ways of detecting spambots only. "tarbaby" has a very different connotation: that it is a TCP or SMTP tarpit. This will make people nervous to

Re: Fake MX

2010-12-09 Thread Karsten Bräckelmann
On Wed, 2010-12-08 at 15:52 -0800, Marc Perkel wrote: > For those who want to try the Fake MX trick you can set your highest MX > to tarbaby.junkemailfilter.com. I'm harvesting spambot data for my black > list. It's a free way to get rid of some spam and punish the spammers. Marc, we've gone thr

Re: Fake MX

2010-12-08 Thread David F. Skoll
On Wed, 08 Dec 2010 15:52:37 -0800 Marc Perkel wrote: > For those who want to try the Fake MX trick you can set your highest > MX to tarbaby.junkemailfilter.com. Sure. I'll publish an MX record potentially sending my domain's mail to a machine I don't control... not. -- David.

Re: Fake MX

2010-12-08 Thread John Hardin
On Wed, 8 Dec 2010, Marc Perkel wrote: Hitting the tarbaby server by itself doesn't get you listed. I have ways of detecting spambots only. "tarbaby" has a very different connotation: that it is a TCP or SMTP tarpit. This will make people nervous to use it. -- John Hardin KA7OHZ

Re: Fake MX

2010-12-08 Thread Marc Perkel
Hitting the tarbaby server by itself doesn't get you listed. I have ways of detecting spambots only. On 12/8/2010 4:02 PM, Michael Scheidell wrote: On 12/8/10 6:52 PM, Marc Perkel wrote: punish the spammers. and, punish any senders who follow the RFC's. -- Marc Perkel - Sales/Support su

Re: Fake MX

2010-12-08 Thread Michael Scheidell
On 12/8/10 6:52 PM, Marc Perkel wrote: punish the spammers. and, punish any senders who follow the RFC's. -- Michael Scheidell, CTO o: 561-999-5000 d: 561-948-2259 ISN: 1259*1300 >*| *SECNAP Network Security Corporation * Certified SNORT Integrator * 2008-9 Hot Company Award Winner, W

Re: Fake MX

2010-12-08 Thread Marc Perkel
On 12/8/2010 12:34 PM, Chris Owen wrote: On Dec 8, 2010, at 2:29 PM, Marc Perkel wrote: Virus bots tend to hit all MX records, perhaps randomly. I get millions of hits every day on the highest numbered MX when there are at least 2 and sometimes as many as 7 lower numbered MX records. We to

Re: Fake MX

2010-12-08 Thread Jason Haar
On 12/09/2010 09:34 AM, Chris Owen wrote: > The other thing we see that always amazes me is that if we have MXs that are > all the same weight, the ones that have the lowest reverse DNS host name get > hit higher. > We merge identical-weighted MX records into one and round-robin the mailserver DN

Re: Fake MX

2010-12-08 Thread Chris Owen
On Dec 8, 2010, at 2:29 PM, Marc Perkel wrote: > Virus bots tend to hit all MX records, perhaps randomly. I get millions of > hits every day on the highest numbered MX when there are at least 2 and > sometimes as many as 7 lower numbered MX records. We too very often see spammers hit the highes

Re: Fake MX

2010-12-08 Thread Marc Perkel
On 12/8/2010 11:46 AM, John Hardin wrote: On Wed, 8 Dec 2010, Toni Mueller wrote: I tried the high MX for some time, but in my experience, spammers usually only hit the first two MXes. I wonder what Marc Perkel's experience in this regard is... Virus bots tend to hit all MX records, perh

Re: Fake MX

2010-12-08 Thread Michael Scheidell
On 12/8/10 2:46 PM, John Hardin wrote: On Wed, 8 Dec 2010, Toni Mueller wrote: I tried the high MX for some time, but in my experience, spammers usually only hit the first two MXes. I wonder what Marc Perkel's experience in this regard is... You just had to stir up the ants. -- Michael Sc

Re: Fake MX

2010-12-08 Thread John Hardin
On Wed, 8 Dec 2010, Toni Mueller wrote: I tried the high MX for some time, but in my experience, spammers usually only hit the first two MXes. I wonder what Marc Perkel's experience in this regard is... -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.

Re: Fake MX

2010-12-08 Thread Raul Dias
I use to do this and it was fine. No problem in the low mx and just added points to the high mx in SA. It did help a little. A while ago I had to disable it because some major ISPs in Brazil start to block me out because of this setup. -rsd On 12/08/2010 03:32 PM, Matt wrote: Anyone using

Re: Fake MX

2010-12-08 Thread Franz Schwartau
Hi Matt! On 08.12.2010 18:33, Matt wrote: > Anyone using the Fake MX trick? > > http://www.webhostingtalk.com/wiki/Fake_MX > > Is it safe to use a fake high and low mx? The term Fake MX doesn't seem to be used consistently. We are using a Fake MX, which responds a temporary error to every e-mai

Re: Fake MX

2010-12-08 Thread Toni Mueller
On Wed, 08.12.2010 at 11:33:11 -0600, Matt wrote: > Anyone using the Fake MX trick? > http://www.webhostingtalk.com/wiki/Fake_MX > Is it safe to use a fake high and low mx? I tried the high MX for some time, but in my experience, spammers usually only hit the first two MXes. So if you were usin

Re: Fake MX

2010-12-08 Thread Bowie Bailey
On 12/8/2010 12:33 PM, Matt wrote: > Anyone using the Fake MX trick? > > http://www.webhostingtalk.com/wiki/Fake_MX > > Is it safe to use a fake high and low mx? Putting a non-responsive MX at the high end is fine. I've been doing that for years ever since I disabled my backup MX and just left th

Re: Fake MX Record(s) Trick

2008-06-25 Thread mouss
Robert - elists wrote: mouss is french, you must know ;-) French mouse? "mousse" means foam. Franciscaner weiss? ;-) http://disney.go.com/disneyvideos/animatedfilms/ratatouille/ No offense intended of course... it really was a cute movie... I loved it. Time for vacations!

Re: Fake MX Record(s) Trick

2008-06-25 Thread Jon Trulson
On Mon, 23 Jun 2008, Marc Perkel wrote: Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm usin

RE: Fake MX Record(s) Trick

2008-06-25 Thread Robert - elists
> > mouss is french, you must know ;-) > French mouse? ;-) http://disney.go.com/disneyvideos/animatedfilms/ratatouille/ No offense intended of course... it really was a cute movie... Time for vacations! - rh

Re: Fake MX Record(s) Trick

2008-06-24 Thread mouss
Michael Monnerie wrote: On Dienstag, 24. Juni 2008 Benny Pedersen wrote: 14400 is 4 hours (4*3660) which is a bit low for an MX 86400 (24 hours) is probably better. nice calc for 4 hours :-) mouss is french, you must know ;-) yep. I have problems with anything but the

Re: Fake MX Record(s) Trick

2008-06-24 Thread Michael Monnerie
On Dienstag, 24. Juni 2008 Benny Pedersen wrote: > > 14400 is 4 hours (4*3660) which is a bit low for an MX 86400 > > (24 hours) is probably better. > > nice calc for 4 hours :-) mouss is french, you must know ;-) mfg zmi -- // Michael Monnerie, Ing.BSc- http://it-management.at

Re: Fake MX Record(s) Trick

2008-06-23 Thread Benny Pedersen
On Mon, June 23, 2008 21:27, mouss wrote: > 14400 is 4 hours (4*3660) which is a bit low for an MX 86400 (24 > hours) is probably better. nice calc for 4 hours :-) Benny Pedersen Need more webspace ? http://www.servage.net/?coupon=cust37098

Re: Fake MX Record(s) Trick

2008-06-23 Thread mouss
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam ( http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and I

Re: Fake MX Record(s) Trick

2008-06-23 Thread mouss
Marc Perkel wrote: Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home an

Re: Fake MX Record(s) Trick

2008-06-23 Thread Marc Perkel
Marc Ferguson wrote: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and

Re: Fake MX Record(s) Trick

2008-06-23 Thread Diego Pomatta
Marc Ferguson escribió: Hi, I'm a linux noob and a spam assassin noob so please reply in simplified language. Thanks. I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop

Re: Fake MX Record(s) Trick

2008-06-23 Thread John Hardin
On Mon, 23 Jun 2008, McDonald, Dan wrote: But I'm not convinced that twiddling with fake MX records will reduce your spam level any. Cue Mr. Perkel... :) -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ [EMAIL PROTECTED]FALaholic #11174 pgpk -a [EMAIL PROTECT

Re: Fake MX Record(s) Trick

2008-06-23 Thread Alex Woick
Marc Ferguson schrieb am 20.06.2008 16:38: I saw on the wiki a trick to use fake mx records in order to weed out spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at home and on my laptop and I have the spamassassin plugin so I'm constantly clicking the "junk" icon.

Re: Fake MX Record(s) Trick

2008-06-23 Thread McDonald, Dan
On Fri, 2008-06-20 at 10:38 -0400, Marc Ferguson wrote: > Hi, > I saw on the wiki a trick to use fake mx records in order to weed out > spam (http://wiki.apache.org/spamassassin/OtherTricks). I'm using > Evolution at home and on my laptop and I have the spamassassin plugin > so I'm constantly cli

Re: Fake MX Record(s) Trick

2008-06-23 Thread Matus UHLAR - fantomas
On 20.06.08 10:38, Marc Ferguson wrote: > I'm a linux noob and a spam assassin noob so please reply in simplified > language. Thanks. > > I saw on the wiki a trick to use fake mx records in order to weed out spam ( > http://wiki.apache.org/spamassassin/OtherTricks). I'm using Evolution at > home

Re: fake MX records

2007-08-15 Thread Aaron Wolfe
On 8/15/07, Wil Hatfield - HyperConX <[EMAIL PROTECTED]> wrote: > > > > This is the biggest problem with "fake" MX records for me. If your > > primary MX is not available, you will simply lose mail from some > > senders. It's entirely their "fault" for violating the RFCs but the > > mail is still

RE: fake MX records

2007-08-15 Thread Wil Hatfield - HyperConX
> > This is the biggest problem with "fake" MX records for me. If your > primary MX is not available, you will simply lose mail from some > senders. It's entirely their "fault" for violating the RFCs but the > mail is still lost, and it isn't easy to explain whats going on to > your users/custom

Re: fake MX records

2007-08-15 Thread Daryl C. W. O'Shea
On 8/15/2007 11:46 AM, Marc Perkel wrote: Daryl C. W. O'Shea wrote: On 8/14/2007 5:52 PM, Marc Perkel wrote: Kai Schaetzl wrote: Marc Perkel wrote on Tue, 14 Aug 2007 07:13:16 -0700: I'm using it on 1600 domains and it definitely works. I get not bot spam at all. I doubt that th

Re: fake MX records

2007-08-15 Thread Richard Frovarp
John D. Hardin wrote: On Wed, 15 Aug 2007, Richard Frovarp wrote: Michael Scheidell wrote: Yes, and some systems might not ever send you email (they violate RFC's) We've had one issue with this. ... There was on weird mailer that is being used that doesn't try other MXs. We w

Re: fake MX records

2007-08-15 Thread John D. Hardin
On Wed, 15 Aug 2007, Richard Frovarp wrote: > Michael Scheidell wrote: > > > Yes, and some systems might not ever send you email (they violate > > RFC's) > > We've had one issue with this. ... There was on weird mailer that > is being used that doesn't try other MXs. We were able to get past >

Re: fake MX records

2007-08-15 Thread Nix
On 15 Aug 2007, Marc Perkel uttered the following: > I'm doing it and I'm not losing email from any senders. How can you possibly tell? You mean `none of the senders who I may have lost email from have noticed it and complained, or at least none have been able to get through to me to complain'. T

Re: fake MX records

2007-08-15 Thread Richard Frovarp
Michael Scheidell wrote: -Original Message- From: ram [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 14, 2007 6:07 AM To: users@spamassassin.apache.org Subject: fake MX records http://wiki.apache.org/spamassassin/OtherTricksthis page mentions setting up fake MXes Is this met

Re: fake MX records

2007-08-15 Thread Marc Perkel
Aaron Wolfe wrote: On 8/14/07, Michael Scheidell <[EMAIL PROTECTED]> wrote: -Original Message- From: ram [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 14, 2007 6:07 AM To: users@spamassassin.apache.org Subject: fake MX records http://wiki.apache.org/spamassassin/OtherTricks

Re: fake MX records

2007-08-15 Thread Marc Perkel
Daryl C. W. O'Shea wrote: On 8/14/2007 5:52 PM, Marc Perkel wrote: Kai Schaetzl wrote: Marc Perkel wrote on Tue, 14 Aug 2007 07:13:16 -0700: I'm using it on 1600 domains and it definitely works. I get not bot spam at all. I doubt that this is because you have a fake low MX. Kai

Re: fake MX records

2007-08-15 Thread John Rudd
Aaron Wolfe wrote: On 8/14/07, Michael Scheidell <[EMAIL PROTECTED]> wrote: -Original Message- From: ram [mailto:[EMAIL PROTECTED] Sent: Tuesday, August 14, 2007 6:07 AM To: users@spamassassin.apache.org Subject: fake MX records http://wiki.apache.org/spamassassin/OtherTricksthis

Re: fake MX records

2007-08-15 Thread Aaron Wolfe
On 8/14/07, Michael Scheidell <[EMAIL PROTECTED]> wrote: > > > > -Original Message- > > From: ram [mailto:[EMAIL PROTECTED] > > Sent: Tuesday, August 14, 2007 6:07 AM > > To: users@spamassassin.apache.org > > Subject: fake MX records > > > > > > http://wiki.apache.org/spamassassin/OtherTric

Re: fake MX records

2007-08-14 Thread Kai Schaetzl
Marc Perkel wrote on Tue, 14 Aug 2007 14:52:22 -0700: > So what do you attribute my success in getting rid of all bot spam to? As I don't know your setup this would be pure speculation. However, as *I* am not using fake MXs, but several other MTA techniques and see not much Botnet spam either I

Re: fake MX records

2007-08-14 Thread Daryl C. W. O'Shea
On 8/14/2007 5:52 PM, Marc Perkel wrote: Kai Schaetzl wrote: Marc Perkel wrote on Tue, 14 Aug 2007 07:13:16 -0700: I'm using it on 1600 domains and it definitely works. I get not bot spam at all. I doubt that this is because you have a fake low MX. Kai So what do you attribut

Re: fake MX records

2007-08-14 Thread Marc Perkel
Kai Schaetzl wrote: Marc Perkel wrote on Tue, 14 Aug 2007 07:13:16 -0700: I'm using it on 1600 domains and it definitely works. I get not bot spam at all. I doubt that this is because you have a fake low MX. Kai So what do you attribute my success in getting rid of all bot spa

Re: fake MX records

2007-08-14 Thread Kai Schaetzl
Marc Perkel wrote on Tue, 14 Aug 2007 07:13:16 -0700: > I'm using it on 1600 domains and it definitely works. I get not bot spam > at all. I doubt that this is because you have a fake low MX. Kai -- Kai Schätzl, Berlin, Germany Get your web at Conactive Internet Services: http://www.conactive

Re: fake MX records

2007-08-14 Thread Marc Perkel
Kshatriya wrote: On Tue, 14 Aug 2007, ram wrote: The page says the primary MX should not be accepting connections at all. Has anyone else tried this , will this cause delay in my mail It almost doesn't work anymore. Better try adaptive greylisting, with some whitelists so you don't notice

Re: fake MX records

2007-08-14 Thread Robert Schetterer
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Kshatriya schrieb: > On Tue, 14 Aug 2007, ram wrote: > >> The page says the primary MX should not be accepting connections at all. >> Has anyone else tried this , will this cause delay in my mail > > It almost doesn't work anymore. Better try adaptiv

Re: fake MX records

2007-08-14 Thread Kshatriya
On Tue, 14 Aug 2007, ram wrote: The page says the primary MX should not be accepting connections at all. Has anyone else tried this , will this cause delay in my mail It almost doesn't work anymore. Better try adaptive greylisting, with some whitelists so you don't notice too much of delays.

RE: fake MX records

2007-08-14 Thread Michael Scheidell
> -Original Message- > From: ram [mailto:[EMAIL PROTECTED] > Sent: Tuesday, August 14, 2007 6:07 AM > To: users@spamassassin.apache.org > Subject: fake MX records > > > http://wiki.apache.org/spamassassin/OtherTricksthis page mentions > setting up fake MXes > > Is this method rel

Re: Fake MX Record

2007-07-22 Thread SM
At 20:17 22-07-2007, Bubuk Gabrok wrote: On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , where do I insert these values: Set your DNS records accordingly. The statement that "No good email is lost" is subjective. Regards, -sm

Re: Fake MX Record

2007-07-22 Thread Bubuk Gabrok
On 7/23/07, Evan Platt <[EMAIL PROTECTED]> wrote: At 08:17 PM 7/22/2007, Bubuk Gabrok wrote: >On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , >where do I insert these values: >fake0.domain.com 10 >realmx.domain.com 20 >fake1.domain.com 30 > >TIA. In your Zonefile for y

Re: Fake MX Record

2007-07-22 Thread Evan Platt
At 08:17 PM 7/22/2007, Bubuk Gabrok wrote: On http://wiki.apache.org/spamassassin/OtherTricks (Fake MX Record) , where do I insert these values: fake0.domain.com 10 realmx.domain.com 20 fake1.domain.com 30 TIA. In your Zonefile for your DNS. Evan