Re: Got dead domains that get a lot of spam?

[Lucio Chiappetti]

On Tue, 19 May 2009, Marc Perkel wrote:

Looking for people with dead domains that still get a lot of spam,

If you have such a domain that you aren't using can you set the MX

Sorry, but that's not dead enough !



The sendmail.cf of the real MX was capable to handle all three domains.



Finally we removed mi.iasf.cnr.it. By "removed" I mean it was cancelled


The immediate effect was a definite cut in spam (see attached plot).

However we are still receiving spam for mi.iasf.cnr.it.
Despite the fact no DNS in the world can find a SOA or MX for it.



But still they attempt ...

--
Lucio Chiappetti - INAF/IASF - via Bassini 15 - I-20133 Milano (Italy)
For more info : http://www.iasf-milano.inaf.it/~lucio/personal.html
-----------------------------------------------------------------------
"Nature" on government cuts to research       http://snipurl.com/4erid
"Nature" e i tagli del governo alla ricerca   http://snipurl.com/4erko

We used to have one domain (mi.iasf.cnr.it) under one organization (CNR). When our institute was moved under another organization (INAF) we got two more domains under inaf.it. Of these one is the "real" domain (where A and PTR records are), and the other one is just an alias (has only MX and CNAMEs pointing to the primary domain). For a while we kept the old cnr.it domain as well, and that was a copy of the alias domain, After a while we removed the CNAMEs of the various http servers and left only the MX. At the time the old domain was receiving mainly spam, plus mail for some users subscribed to mailing lists which did not change domain, plus a few odd mails from lazy correspondents. from the delegations issued by iasf.cnr.it, there is no SOA at all. We also changed our sendmail.cf which now handles only our two inaf.it domains. Apparently the spammers had kept track of the IP of the old MX (which has always been the same machine for all domains), and continue sending to it. Of course our sendmail rejects it immediately with a "cannot relay", since it interprets the non-existing (aka "really dead") domain as an external one.

history07.png
Description: Binary data