From vesely@tana.it Mon Feb 4 03:34:46 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E6F7721F8473 for ; Mon, 4 Feb 2013 03:34:46 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.269 X-Spam-Level: X-Spam-Status: No, score=-3.269 tagged_above=-999 required=5 tests=[AWL=-1.150, BAYES_50=0.001, HELO_EQ_IT=0.635, HOST_EQ_IT=1.245, RCVD_IN_DNSWL_MED=-4] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 3poFIVbOx9fY for ; Mon, 4 Feb 2013 03:34:46 -0800 (PST) Received: from wmail.tana.it (wmail.tana.it [62.94.243.226]) by ietfa.amsl.com (Postfix) with ESMTP id 2DF2121F8467 for ; Mon, 4 Feb 2013 03:34:45 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=tana.it; s=beta; t=1359977682; bh=HF7AXVXiTPIXCrSyNH/pjLKrEPeUXne+0liB9wW+9w8=; l=994; h=Date:From:To:References:In-Reply-To; b=qJeq5YCA8KGc6ye2WCwgMFzgOrWioyBmEBz9vzZwH2cCu+8q7DlLNYKUVykvjnKj3 W2yIIeJlDMPEYTwD4qdd++lNZpZjcefdSeJWLcE1OXrTcuTYPz0Oq+JXo4HtpT0+BH vF2GuaBeZxlL6cPQkra1JP4nBflBJNSzesVWXQds= Received: from [172.25.197.158] (pcale.tana [172.25.197.158]) (AUTH: CRAM-MD5 uXDGrn@SYT0/k, TLS: TLSv1/SSLv3,256bits,AES256-SHA) by wmail.tana.it with ESMTPSA; Mon, 04 Feb 2013 12:34:42 +0100 id 00000000005DC02B.00000000510F9CD2.0000530E Message-ID: <510F9CD2.9060207@tana.it> Date: Mon, 04 Feb 2013 12:34:42 +0100 From: Alessandro Vesely User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:17.0) Gecko/20130107 Thunderbird/17.0.2 MIME-Version: 1.0 To: asrg@irtf.org References: <5103DC4E.4090004@mtcc.com> <5103FE36.7010908@mustelids.ca> <51093ED6.9010401@mustelids.ca> In-Reply-To: <51093ED6.9010401@mustelids.ca> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Subject: [Asrg] more validation methods, was spam down? X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 04 Feb 2013 11:34:47 -0000 On Wed 30/Jan/2013 16:40:06 +0100 Chris Lewis wrote: > > Validation is so irrelevant that the spammers impersonate sites when > it's clearly unnecessary. They use their facebook impersonation > templates to send out pill spam for crissakes. If validation was making > a difference, the ROI would suffer. I can only guess it isn't. That seems to be true, sadly. Looking at myself, the reason why I don't use authentication results is because so few messages bear any. If they covered a significant percentage of messages (and spam), I'd use the data in those A-R header fields to send complaints, implementing RFC 6650, according to the discussions we already had. A way to enlarge the covered base is to add more authentication methods. For example, "dnswl" would be quite similar to "vbr", "iprev" is already defined, "rdap" is a promising new feature. By adding those, I'd expect it will become fairly difficult to find messages with no authentication at all. Correct? From martijn.grooten@virusbtn.com Tue Feb 12 03:01:21 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B169521F8CD0 for ; Tue, 12 Feb 2013 03:01:21 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -8.092 X-Spam-Level: X-Spam-Status: No, score=-8.092 tagged_above=-999 required=5 tests=[AWL=-0.093, BAYES_50=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id rGASfQZjr0W6 for ; Tue, 12 Feb 2013 03:01:21 -0800 (PST) Received: from mx6.sophos.com (mx6.sophos.com [195.171.192.176]) by ietfa.amsl.com (Postfix) with ESMTP id D749B21F8CD1 for ; Tue, 12 Feb 2013 03:01:19 -0800 (PST) Received: from mx6.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id 3C1AF7518DF for ; Tue, 12 Feb 2013 11:01:17 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos (unknown [10.100.70.61]) by mx6.sophos.com (Postfix) with ESMTPS id 174727518D6 for ; Tue, 12 Feb 2013 11:01:17 +0000 (GMT) Received: from abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352]) by ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d%16]) with mapi id 14.02.0247.003; Tue, 12 Feb 2013 11:01:17 +0000 From: Martijn Grooten To: "Anti-Spam Research Group - IRTF (asrg@irtf.org)" Thread-Topic: Some statistics on SPF and spam Thread-Index: Ac4JDkhL3olESDoZQtiqFxWmWQ01Cg== Date: Tue, 12 Feb 2013 11:01:16 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20BBE549@abn-exch1b.green.sophos> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.110.54] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Asrg] Some statistics on SPF and spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Feb 2013 11:01:21 -0000 I had promised to produce some stats on SPF and spam. Over the Christmas holidays, I sent over 60k spam messages through 21 spam = filters in the spam-filter test I run regularly. I checked the SPF status o= f the messages and measured how many filters failed to block each message. Here are the results: SPF fail: 3171 emails, on average missed by 0.24 filters (out of 21) with a= standard deviation of 0.04. SPF pass: 8106 emails, avg 0.93, stddev 0.23 SPF softfail: 8672 emails, avg 0.45, stddev 0.09 SPF neutral: 13466 emails, avg 0.34, stddev 0.04 SPF none: 26938 emails, avg 0.43, stddev 0.06 A neater table and a graph can be found here: http://www.virusbtn.com/news/= 2013/02_04.xml Now correlation doesn't imply causation and there are good reasons why the = relationship here may not causal, but let's for a moment we assume it is. This means that if you're a spammer, failing SPF isn't a good idea, while m= aking sure your emails pass SPF means you're more likely to see your messag= es delivered, but you by no means get a free ride to users' inboxes. If you find a 'clever' way to avoid failing SPF by using a domain with no S= PF record, there is only a small improvement in your delivery rates. Martijn. ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. From darxus@chaosreigns.com Tue Feb 12 11:55:53 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 6DBAF21F8D49 for ; Tue, 12 Feb 2013 11:55:53 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.6 X-Spam-Level: X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, NO_RELAYS=-0.001] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id JvnWaj9Pp0ev for ; Tue, 12 Feb 2013 11:55:52 -0800 (PST) Received: from panic.chaosreigns.com (panic.chaosreigns.com [IPv6:2600:3c01::f03c:91ff:fe96:340b]) by ietfa.amsl.com (Postfix) with ESMTP id 7A33421F8C51 for ; Tue, 12 Feb 2013 11:55:49 -0800 (PST) Received: by panic.chaosreigns.com (Postfix, from userid 1000) id 14583CD336; Tue, 12 Feb 2013 14:55:49 -0500 (EST) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=chaosreigns.com; s=mail; t=1360698949; bh=jSO7Uij3Hy2v8Dr66AVX7kbYri3yThzY0H3+KOcbwZ8=; h=Date:From:To:Subject:References:In-Reply-To; b=lYX7D3QDC1xUymL8r3IidmsJZ0CypWhPxpwqJ/bUom3NJFPEfdHNvFfCccWqXf222 1jhA+2i+2zCwzuN6SELr6ZIG1l7gruMtYLQUKFEGeklVXFbD9cF4fbbm0O9KzjPsJM AT7tXpWs/h+hjZrr6Jzodh91ErZ4GUPK03Rf6hHU= Date: Tue, 12 Feb 2013 14:55:49 -0500 From: darxus@chaosreigns.com To: asrg@irtf.org Message-ID: <20130212195549.GB26133@chaosreigns.com> References: <0D79787962F6AE4B84B2CC41FC957D0B20BBE549@abn-exch1b.green.sophos> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <0D79787962F6AE4B84B2CC41FC957D0B20BBE549@abn-exch1b.green.sophos> User-Agent: Mutt/1.5.20 (2009-06-14) Subject: Re: [Asrg] Some statistics on SPF and spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Feb 2013 19:55:53 -0000 I didn't see the discussion where you promised to produce this, but I think the problem is how much non-spam also fails SPF. >From ruleqa.spamassassin.org/?daterev=20130211-r1444680-n&rule=%2Fspf : MSECS SPAM% HAM% S/O RANK SCORE NAME WHO/AGE 0 0.0236 0.9635 0.024 0.15 0.00 SPF_FAIL 0 0.0383 0.3059 0.111 0.27 0.00 SPF_SOFTFAIL Way more non-spam is failing than spam. Catching spam is easy. Doing so without excessive false positives is what's hard. On 02/12, Martijn Grooten wrote: > I had promised to produce some stats on SPF and spam. > > Over the Christmas holidays, I sent over 60k spam messages through 21 spam filters in the spam-filter test I run regularly. I checked the SPF status of the messages and measured how many filters failed to block each message. > > Here are the results: > SPF fail: 3171 emails, on average missed by 0.24 filters (out of 21) with a standard deviation of 0.04. > SPF pass: 8106 emails, avg 0.93, stddev 0.23 > SPF softfail: 8672 emails, avg 0.45, stddev 0.09 > SPF neutral: 13466 emails, avg 0.34, stddev 0.04 > SPF none: 26938 emails, avg 0.43, stddev 0.06 > > A neater table and a graph can be found here: http://www.virusbtn.com/news/2013/02_04.xml > > Now correlation doesn't imply causation and there are good reasons why the relationship here may not causal, but let's for a moment we assume it is. > > This means that if you're a spammer, failing SPF isn't a good idea, while making sure your emails pass SPF means you're more likely to see your messages delivered, but you by no means get a free ride to users' inboxes. > > If you find a 'clever' way to avoid failing SPF by using a domain with no SPF record, there is only a small improvement in your delivery rates. > > Martijn. > > > ________________________________ > > Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. > Company Reg No: 2388295. VAT Reg No: GB 532 5598 33. > _______________________________________________ > Asrg mailing list > Asrg@irtf.org > http://www.irtf.org/mailman/listinfo/asrg > -- "Begin at the beginning and go on till you come to the end; then stop." - Lewis Carrol, Alice in Wonderland http://www.ChaosReigns.com From prvs=1755669d32=lists@hireahit.com Tue Feb 12 13:41:48 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B6BEA21F8CA5 for ; Tue, 12 Feb 2013 13:41:48 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -3.599 X-Spam-Level: X-Spam-Status: No, score=-3.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, RCVD_IN_DNSWL_LOW=-1] Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id BWOEEKq3SRUS for ; Tue, 12 Feb 2013 13:41:48 -0800 (PST) Received: from vinny.hireahit.com (vinny.hireahit.com [72.51.42.137]) by ietfa.amsl.com (Postfix) with ESMTP id D31EF21F8C9F for ; Tue, 12 Feb 2013 13:41:47 -0800 (PST) Received: from [172.24.0.107] by hireahit.com (vinny.hireahit.com) (SecurityGateway 2.1.0a) with SMTP id SG003342989.MSG for ; Tue, 12 Feb 2013 13:41:45 -0800 Message-ID: <511AB715.6000301@hireahit.com> Date: Tue, 12 Feb 2013 13:41:41 -0800 From: Dave Warren User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:19.0) Gecko/20130117 Thunderbird/19.0 MIME-Version: 1.0 To: asrg@irtf.org References: <0D79787962F6AE4B84B2CC41FC957D0B20BBE549@abn-exch1b.green.sophos> <20130212195549.GB26133@chaosreigns.com> In-Reply-To: <20130212195549.GB26133@chaosreigns.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-SGOP-RefID: fgs=0 (_st=1 _vt=0 _iwf=0) Subject: Re: [Asrg] Some statistics on SPF and spam X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 12 Feb 2013 21:41:48 -0000 On 2/12/2013 11:55, darxus@chaosreigns.com wrote: > I didn't see the discussion where you promised to produce this, but I think > the problem is how much non-spam also fails SPF. > > From ruleqa.spamassassin.org/?daterev=20130211-r1444680-n&rule=%2Fspf : > > MSECS SPAM% HAM% S/O RANK SCORE NAME WHO/AGE > 0 0.0236 0.9635 0.024 0.15 0.00 SPF_FAIL > 0 0.0383 0.3059 0.111 0.27 0.00 SPF_SOFTFAIL > > Way more non-spam is failing than spam. If you just use SPF for positive scoring and never for negative scoring or blocking then that's okay. I'm also note suggesting that SPF or DKIM or similar alone is sufficient for positive scoring, but when combined with a local whitelist, I can aggressively whitelist companies that we do business with without having to worry about a spammer spoofing a whitelisted major corporation. When the company starts sending mail from a non-listed IP, they don't get the benefit of whitelisting, but nothing else "breaks", so there's no harm done. > Catching spam is easy. Doing so without excessive false positives is > what's hard. Amen. I guarantee you that I can block every single spam, 100% of the time, no questions asked, as long as one of the unasked questions is the false positive percentage. -- Dave Warren http://www.hireahit.com/ http://ca.linkedin.com/in/davejwarren From martijn.grooten@virusbtn.com Mon Feb 25 07:06:11 2013 Return-Path: X-Original-To: asrg@ietfa.amsl.com Delivered-To: asrg@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id EBA0221F945C for ; Mon, 25 Feb 2013 07:06:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -7.999 X-Spam-Level: X-Spam-Status: No, score=-7.999 tagged_above=-999 required=5 tests=[BAYES_50=0.001, RCVD_IN_DNSWL_HI=-8] Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id ouKexqRmOI10 for ; Mon, 25 Feb 2013 07:06:11 -0800 (PST) Received: from mx3.sophos.com (mx3.sophos.com [216.47.234.212]) by ietfa.amsl.com (Postfix) with ESMTP id 33B2621F945B for ; Mon, 25 Feb 2013 07:06:10 -0800 (PST) Received: from mx3.sophos.com (localhost.localdomain [127.0.0.1]) by localhost (Postfix) with SMTP id BC05A188484 for ; Mon, 25 Feb 2013 15:06:09 +0000 (GMT) Received: from ABN-EXCH1A.green.sophos (abn-exch1a.green.sophos [10.100.70.61]) by mx3.sophos.com (Postfix) with ESMTPS id 6B20C1883B7 for ; Mon, 25 Feb 2013 15:06:09 +0000 (GMT) Received: from abn-exch1b.green.sophos ([fe80::dc96:facf:3d2c:c352]) by ABN-EXCH1A.green.sophos ([fe80::67:3150:dacd:910d%15]) with mapi id 14.02.0328.009; Mon, 25 Feb 2013 15:06:08 +0000 From: Martijn Grooten To: "Anti-Spam Research Group - IRTF (asrg@irtf.org)" Thread-Topic: CFP: VB2013, Berlin, Germany Thread-Index: Ac4TaQefvUkmvTLJR1mU/Qxen0PabQ== Date: Mon, 25 Feb 2013 15:06:07 +0000 Message-ID: <0D79787962F6AE4B84B2CC41FC957D0B20BF9C42@abn-exch1b.green.sophos> Accept-Language: en-GB, en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [10.100.110.37] Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Subject: [Asrg] CFP: VB2013, Berlin, Germany X-BeenThere: asrg@irtf.org X-Mailman-Version: 2.1.12 Precedence: list Reply-To: Anti-Spam Research Group - IRTF List-Id: Anti-Spam Research Group - IRTF List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 25 Feb 2013 15:06:12 -0000 Apologies if you've seen this before. Deadline in 11 days. Conference in Oc= tober. Martijn. VB2013, BERLIN: CALL FOR PAPERS Virus Bulletin is seeking submissions from those wishing to present papers = at VB2013, the 23rd Virus Bulletin International Conference, which will tak= e place 2-4 October 2013 at the Maritim Hotel Berlin in Berlin, Germany. The conference will include a programme of 30-minute presentations running = in two concurrent streams: Technical and Corporate. Submissions are invited= on all subjects relevant to the threat landscape. In particular, VB welcom= es the submission of papers that will provide delegates with ideas, advice = and/or practical techniques, and encourages presentations that include prac= tical demonstrations of techniques or new technologies. Abstracts should be submitted via the online abstract submission system at = http://www.virusbtn.com/conference/abstracts/ and must be submitted no late= r than FRIDAY 8th MARCH 2013. Further details of the paper submission and selection process, including a = list of suggested topics for papers, can be found at http://www.virusbtn.co= m/conference/vb2013/call/ ________________________________ Virus Bulletin Ltd, The Pentagon, Abingdon, OX14 3YP, England. Company Reg No: 2388295. VAT Reg No: GB 532 5598 33.