Mailing-List: contact server-dev-help@james.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "James Developers List" <server-dev@james.apache.org>
Content-Class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
Subject: RE: Contributing a mailet
Date: Wed, 4 Feb 2004 09:47:53 -0600
Message-ID: 
 <61C1CA24B8657047893FCF3570BC757D01EFBA1D@daebe008.americas.nokia.com>
Thread-Topic: Contributing a mailet
Thread-Index: AcPqqCaCBCaNY2P8TUi1ETOoP3KrdQAiGPhg
From: <Bruno.Melloni@nokia.com>
To: <server-dev@james.apache.org>

Validating IP against the domain was one of many tests I was planning to =
do.  It will probably block a few legal mail servers, but that should =
provide an incentive to add those servers/domains to DNS and be better =
net-citizens.

The TMDA whitelist-centric strategy looks similar to what I was thinking =
of.  But I find the email-based challenge/response might not be too =
difficult for spammers to circumvent.  In any case they seem to have =
looked at many of the issues and is a great cross-check to ensure I did =
not miss something important.

Thanks for the link!!!

Bruno

-----Original Message-----
From: ext Noel J. Bergman [mailto:noel@devtech.com]
Sent: Tuesday, February 03, 2004 4:50 PM
To: James Developers List
Subject: RE: Contributing a mailet


> spammers are getting very smart about bypassing normal anti-spam
> tools.

They have gone from being annoying, with dubious legal status for UCE, =
to
being outright criminals.  Spammers are behind the new worms that turn
consumer systems into mail daemons.  They can bypass whitelists by using =
the
address books of the systems they have infected, and distributing the
information so that databases of e-mail associations can be constructed.

> I feel that no other solution other than pure whitelisting will work
> in the long run.

> What alternative would you propose to whitelist-only email?

Are you familar with www.tmda.net?

There is a proposal where an MTA would validate that the IP address
attaching to it is a valid server for the MAIL FROM domain.  There are
proposals to have servers sign messages to verify that the message did,
indeed, originate from them.

	--- Noel


---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: server-dev-unsubscribe@james.apache.org
For additional commands, e-mail: server-dev-help@james.apache.org