paid option: exclusive use of new server for spam-filtered outgoing mail

FMradio · 7 Feb 2005, 03:11 PM

In this post from June 2003, hadaso wrote:

Quote:

It has been suggested that outgoing mail ca be scanned for spam. Perhaps this can be done on a limited basis by bccing all messages from new accounts to a special account for spamassasin scanning. Messages with high spamassasin score should then alert the operators of the service, so the sending of spam can be stopped in real-time. This would be done on new accounts, i.e., accounts several days old, or accounts that have sent only very few messages since they were openned (in case a spammer is collecting "legitimate accounts" for future use. It can also be used on suspected accounts if operators are in doubt about them. The FastMail TOS certainly allows the scanning of outgoing mail for the purpose of finding spam or other violatins of the TOS.

It looks like suggestions like this have been made for some time now - certainly long before I had ever heard of FM and started reading these forums, so I really don't know the full history of discussion here. More recent threads like this indicate that there is still a problem with blacklisting due to spam sent via FM servers that needs to be solved, at least as far as some FM users (and potential customers) are concerned.

I'd pay to see more effective anti-spam measures implemented. Occasional bogus blacklisting may always be a fact of life for an email service provider, but seems like there is still room for improvement for FM here.

So - how much would I be willing to pay, and what would I want to see for the extra money? For starters, at least $20 more per year to have my email sent from a server that does a spam check on outgoing mail. That's about what I'd end up paying to another provider for a backup SMTP service anyway.

If there are just 500 more customers for this level of service from FM, that would mean about $10,000 to help cover cost of implementing and managing a new spam-filtering SMTP server. Maybe that's not so much - just enough to take seriously as a starting point.

While I'm not expecting to see 500 "sign me up" responses to this post (not sure if even 500 people will read this) - it would be helpful to get some feedback from people who would not be willing to pony up a few bucks to see FM move more quickly on something along these lines.

Inviting more suggestions for better ideas as well ...

robmueller · 8 Feb 2005, 09:01 AM

I guess we have a number of options that I can think of:
1. Scan all outgoing email through SA, and if above a certain score, block the email, or if too many from that user, block the user.
Pros: Catch spam and users quickly
Cons: Makes it hard for people to forward spam. Would be bad to lock a users accounts who's trying to forward spam to a reporting service???

2. Scan all outgoing email through SA, and if above a certain score, still let the email out, but bcc the administrator for checking.
Pros: Helps catch and stop spam quickly, without automatically locking down customers
Cons: Manual intervention required. Doesn't stop short, fast runs.

3. Have separate outgoing email servers for paying customers to avoid RBLs
Pros: Stop paying customers being affected by free users getting us on an RBL
Cons: Spammers use stolen credit cards to signup accounts anyway, so it's not necessarily the free accounts that get us on list

So none of these really are a perfect solution.

Having said that, we already do go to quite some lengths to try and catch this outgoing spam stuff, and I'm pretty sure there is not actually much going out, and the times we have been hit by an RBL, it's really only been spamcop, and almost certainly it's been done by specifically targeting spamcop contributers.

What proof do I have for that? Well right now none explicitly, but if we get hit again, we'll be able to tell from the following:
1. Our outgoing mail volumes are quite predictable (very obvious weekly cycle with dips/peaks for holidays and the like).
2. Comparing how many hits on average we get at spamcop per day vs the number of hits we got on that particular day

If we get listed, we can compare the ratio of number of hits we get on that day to most days, compare to the raio of email sent vs email sent on that particular day. If there's no significant increase in total amount of email sent on that day, we'll know it's due to specifically being targeted, which is basically an unstoppable problem if someone is determined enough.

Rob

elvey · 9 Feb 2005, 06:50 AM

You'd have to do something to avoid FPs of folks emailing spam for legit reasons in general. (e.g. detecting email to @spamcop.net (spam reports) or abuse@ or @abuse would catch a bit, but not close to all...). I think that scanning outgoing email could be replaced with the first suggestion I made HERE which wouldn't have a much lower FP rate (and it's probably generally a good idea to keep an eye on bounce/rejects in general!)

_One wouldn't want to disable accounts used for forwarding spam for legitimate reasons (such as those reporting, discussing, or monitoring abuse, or that forward ALL mail)._

There's apparrent ongoing low-level abuse of FM by spammers that scheme you just suggested wouldn't notice. Spamcop gets about a valid report a day of spam sent via a free FM account. Rob, I don't think your scheme is accurate enough to allow this abuse to emerge from the noise inherent in the variability of outgoing mail volume.

[Edit: note, I made that suggestion well over a year ago, and well over a year ago, Jeremy said it was a planned enhancement.]

FMradio · 9 Feb 2005, 11:44 AM

Rob and Elvey - thanks for the thoughtful responses.

I should make it clear that the proposal for a separate "super clean" (filtered) SMTP server is not meant as a solution for the bigger problem.

While dealing with abuse by spammers is a huge and hairy task, it should be possible to provide a specific server that FM users can rely on to send their most important email without ever running into a blacklist.

This would be a restricted-use server, so would not be able to be used for forwarding spam for reporting purposes. Other restrictions (such as number of messages that can be sent per hour) should also be understood ahead of time by FM users who choose to sign up for this "added value" service.

No doubt, the larger problem of keeping all of FM's outgoing mail servers as "clean" as possible still needs to be solved too. But while all that's still being figured out, having a separate SMTP server specially designed to stay off the blacklists would provide a welcome safety valve for many FM users.

While successful implementation of this might reduce pressure on FM to keep working on the bigger problem, the bottom line is that it should be there for the sake of the many users now regularly caught in the crossfire between spam police and thieves ...

elvey · 10 Feb 2005, 09:01 AM

{Begin stump speech}
It seems to me that if given a choice between
efforts aimed at
(1)preventing the abuse
and
(2)not preventing the abuse but avoiding the consequences

that (1) is categorically the best option.

(2)will just focus the consequences on users not using this new server, and delay the inevitable need to effect (1).

Implementing "script blocking technology" or "Monitoring Bounce Rates" as described on the wiki are not hard problems.

Blaming the victim (e.g blaming the folks who use the blacklists FM gets listed on) falls into category (2).

FMradio · 14 Feb 2005, 07:37 PM

Okay, have to recognize some valid points there. I'd like to focus discussion here as much as possible on technical aspects, and can see that the question may need to be reframed a bit to get to some agreement on "how" and "when" rather than getting stuck on "whether" or "why" ....

Reading Rob's post again, I see a concern voiced about scanning ALL outgoing mail through SpamAssassin due to potential problem with automatically locking accounts from which spam is forwarded for legitimate reporting purposes.

Quote:

Originally posted by robmueller
I guess we have a number of options that I can think of:
1. Scan all outgoing email through SA, and if above a certain score, block the email, or if too many from that user, block the user.
Pros: Catch spam and users quickly
Cons: Makes it hard for people to forward spam. Would be bad to lock a users accounts who's trying to forward spam to a reporting service???

Elvey pointed out that problems with false-positives would also need to be avoided for FM accounts set to forward ALL mail elsewhere (including spam).

I think that both of these complications might be initially handled by phasing in the filtering of outgoing mail - allowing FM customers to choose whether their mail would be sent from the filtered server or if for some reason they prefered to stay on the "unfiltered" server(s).

So, consider the scenario where most users choose to have outgoing mail sent through the filtered server. (This might allow forwarding as well, as long as the incoming mail had already passed the same SpamAssassin rules set for outgoing mail - thus avoiding false positives in this case).

Some number of users would still choose to use the unfiltered SMTP for whatever reason. The possibility of abuse by spammers and problems with blacklists would still need to be dealt with on these servers. However, these needles would be hiding in a much smaller haystack - especially in the case of new users who have self-selected to use the unfiltered SMTP.

Also should note that Elvey's suggestion to monitor bounce rates would make sense to use with or without filtered SMTP. If that's simpler to implement than filtering, then it would be good to make it a priority.

Still inviting more thoughtful analysis and suggestions ...

elvey · 15 Feb 2005, 01:30 PM

Since monitoring bounce rates is likely to be something generally useful, has the suggestion been passed on to the forum (in the generic sense of the term, i.e. postfix-devel@postfix.dom) used by the developers of the software used for outgoing mail? Is Postfix used for all outgoing mail?
PFQueue looks closely related to what I proposed.

Logfile analysis

This thread suggests that one of the tools didn't have the needed functionality in '02, but suggests how it might be added.

FMradio · 18 Feb 2005, 05:22 PM

re monitoring bounce rates: this paper (pdf file) by Richard Clayton discusses results from implementation of a bounce-monitoring system for a large ISP in the UK. (Also, slides from a presentation of the paper for the "Cliffs notes" version.)

Edit: reading Clayton's paper more carefully, the system is more than a simple "bounce" monitor. The actual heuristics and a few key comments from the paper have been excerpted for more discussion in a page in the FM wiki

Should note that this monitoring system was not automated in realtime, and was implemented with the Exim (rather than Postfix) mailer - still may be useful as a point of reference. Apparently, source code for the project may become available:

Quote:

We wish to thank Demon Internet for their support in developing this system from its initial experimental concept into a production system, and for their far-sightedness in proposing to release it to other ISPs under the GPL.

I wonder if FM might be able to tap Clayton for some useful input on this one?

Edit - corrected link to slide presentation.
Edit - added link to FM wiki page.

december · 21 Feb 2005, 12:41 PM

I believe postfix can send copies of bounces to a predefined email address. If you would send all bounces received at that email address through a script that keeps track of unusually 'high' rates, you can let it react like you want -- a short ban on sending more emails, for instance.

Or, reduce the number of emails free accounts can send per hour.

hadaso · 9 Mar 2005, 06:12 AM

Quote:

Originally posted by robmueller
...
2. Scan all outgoing email through SA, and if above a certain score, still let the email out, but bcc the administrator for checking.
Pros: Helps catch and stop spam quickly, without automatically locking down customers
Cons: Manual intervention required. Doesn't stop short, fast runs.
...

Probably this can be done first to learn how it works (how much spam is going out, how much is from "forward all" accounts, how much from reporting spam etc.) and then you will have more info to work with.

I don't see how a separate "clean" server can be implemented that is used sometimes, while the "unclean" one is used at other times, without many complications, and I don't see the need: Anyone using the internet connects through an ISP, and that includes access to the ISP's SMTP servers in all cases I know. So if one needs to use a separate server for sending sometimes, one has access to the ISP's server.

10 Feb 2005, 09:01 AM	#5
elvey The "e" in e-mail Join Date: Jan 2002 Location: San Francisco Posts: 2,458	{Begin stump speech} It seems to me that if given a choice between efforts aimed at (1)preventing the abuse and (2)not preventing the abuse but avoiding the consequences that (1) is categorically the best option. (2)will just focus the consequences on users not using this new server, and delay the inevitable need to effect (1). Implementing "script blocking technology" or "Monitoring Bounce Rates" as described on the wiki are not hard problems. Blaming the victim (e.g blaming the folks who use the blacklists FM gets listed on) falls into category (2). Last edited by elvey : 10 Feb 2005 at 09:22 AM.

8 Feb 2005, 09:01 AM	#2
robmueller Intergalactic Postmaster Join Date: Oct 2001 Location: Melbourne, Australia Posts: 6,102 Representative of: Fastmail.FM	I guess we have a number of options that I can think of: 1. Scan all outgoing email through SA, and if above a certain score, block the email, or if too many from that user, block the user. Pros: Catch spam and users quickly Cons: Makes it hard for people to forward spam. Would be bad to lock a users accounts who's trying to forward spam to a reporting service??? 2. Scan all outgoing email through SA, and if above a certain score, still let the email out, but bcc the administrator for checking. Pros: Helps catch and stop spam quickly, without automatically locking down customers Cons: Manual intervention required. Doesn't stop short, fast runs. 3. Have separate outgoing email servers for paying customers to avoid RBLs Pros: Stop paying customers being affected by free users getting us on an RBL Cons: Spammers use stolen credit cards to signup accounts anyway, so it's not necessarily the free accounts that get us on list So none of these really are a perfect solution. Having said that, we already do go to quite some lengths to try and catch this outgoing spam stuff, and I'm pretty sure there is not actually much going out, and the times we have been hit by an RBL, it's really only been spamcop, and almost certainly it's been done by specifically targeting spamcop contributers. What proof do I have for that? Well right now none explicitly, but if we get hit again, we'll be able to tell from the following: 1. Our outgoing mail volumes are quite predictable (very obvious weekly cycle with dips/peaks for holidays and the like). 2. Comparing how many hits on average we get at spamcop per day vs the number of hits we got on that particular day If we get listed, we can compare the ratio of number of hits we get on that day to most days, compare to the raio of email sent vs email sent on that particular day. If there's no significant increase in total amount of email sent on that day, we'll know it's due to specifically being targeted, which is basically an unstoppable problem if someone is determined enough. Rob

9 Feb 2005, 06:50 AM	#3
elvey The "e" in e-mail Join Date: Jan 2002 Location: San Francisco Posts: 2,458	You'd have to do something to avoid FPs of folks emailing spam for legit reasons in general. (e.g. detecting email to @spamcop.net (spam reports) or abuse@ or @abuse would catch a bit, but not close to all...). I think that scanning outgoing email could be replaced with the first suggestion I made HERE which wouldn't have a much lower FP rate (and it's probably generally a good idea to keep an eye on bounce/rejects in general!) _One wouldn't want to disable accounts used for forwarding spam for legitimate reasons (such as those reporting, discussing, or monitoring abuse, or that forward ALL mail)._ There's apparrent ongoing low-level abuse of FM by spammers that scheme you just suggested wouldn't notice. Spamcop gets about a valid report a day of spam sent via a free FM account. Rob, I don't think your scheme is accurate enough to allow this abuse to emerge from the noise inherent in the variability of outgoing mail volume. [Edit: note, I made that suggestion well over a year ago, and well over a year ago, Jeremy said it was a planned enhancement.]

9 Feb 2005, 11:44 AM	#4
FMradio Member Join Date: Dec 2004 Location: California Posts: 85	Rob and Elvey - thanks for the thoughtful responses. I should make it clear that the proposal for a separate "super clean" (filtered) SMTP server is not meant as a solution for the bigger problem. While dealing with abuse by spammers is a huge and hairy task, it should be possible to provide a specific server that FM users can rely on to send their most important email without ever running into a blacklist. This would be a restricted-use server, so would not be able to be used for forwarding spam for reporting purposes. Other restrictions (such as number of messages that can be sent per hour) should also be understood ahead of time by FM users who choose to sign up for this "added value" service. No doubt, the larger problem of keeping all of FM's outgoing mail servers as "clean" as possible still needs to be solved too. But while all that's still being figured out, having a separate SMTP server specially designed to stay off the blacklists would provide a welcome safety valve for many FM users. While successful implementation of this might reduce pressure on FM to keep working on the bigger problem, the bottom line is that it should be there for the sake of the many users now regularly caught in the crossfire between spam police and thieves ...

15 Feb 2005, 01:30 PM	#7
elvey The "e" in e-mail Join Date: Jan 2002 Location: San Francisco Posts: 2,458	Since monitoring bounce rates is likely to be something generally useful, has the suggestion been passed on to the forum (in the generic sense of the term, i.e. postfix-devel@postfix.dom) used by the developers of the software used for outgoing mail? Is Postfix used for all outgoing mail? PFQueue looks closely related to what I proposed. Logfile analysis This thread suggests that one of the tools didn't have the needed functionality in '02, but suggests how it might be added.

21 Feb 2005, 12:41 PM	#9
december = Permanently banned = Join Date: Feb 2005 Posts: 11	I believe postfix can send copies of bounces to a predefined email address. If you would send all bounces received at that email address through a script that keeps track of unusually 'high' rates, you can let it react like you want -- a short ban on sending more emails, for instance. Or, reduce the number of emails free accounts can send per hour.