Well-Known E-mailers Back Spamhaus in Amicus Brief

From Ken Magill, published on Direct Magazine's website:

Twenty-nine individuals and organizations have signed onto an amicus brief filed last week in support of anti-spam blacklisting service Spamhaus in its court battle against e-mail marketer e360 Insight.

Some well known, smart guys weighed in here. John Levine, as an example: “In think the court made a mistake in that they really should have figured out that Spamhaus is in London and not in Chicago,” said Levine. “Beyond that, Spamhaus is by far the facility that gets rid of the most spam with the fewest bad side effects. It would be really bad for the community if they couldn't keep doing that. … Spamhaus does try reasonably hard to make sure they don’t block good mail.”

Read more here...

You'll find the brief itself here.

e360 vs Spamhaus: Sparring in the Newsgroups

Oh boy, the things you find on the newsgroups sometimes.

Here's a link to a thread on the news.admin.net-abuse.email newsgroup where Spamhaus and E360 decided to battle it out in the court of public opinion on Friday. What's the goal here? This works to the advantage of whom, exactly? Didn't the old adage used to say that the best case to try a lawsuit was in a courtroom?

I wonder how many of these newsgroup posts are going to end up as evidence in the ongoing appeals in the whole E360 versus Spamhaus lawsuit.

Riddle me this, if you please: If Spamhaus loses their appeal, then what's the actual impact to them? That the Spamhaus folks won't be able to travel to the US? That US ISPs will be afraid to use a foreign blacklist with judgements against it? It seems like a long shot that E360 will actually silence Spamhaus, regardless of the outcome here. But, as they say, "IANAL" (I am not a lawyer), so I'll just have to keep an eye out to see what happens next.

On another note, is E360 apparently telling anti-spam activist Mark Ferguson that he did indeed sign up for email from E360. True? False? Forgery? Harvested address? I wonder if E360 will be able to produce information that ties a signup request back to the person in question.

In a possibly-unrelated item, E360 has also posted the following information on their website:
Eant et fugiant a te inquieti iniqui. et tu vides eos et et ecce pulchra imperium tuum dehonestaverunt,distinguis umbras, et ecce pulchra imperium tuum dehonestaverunt, a caelis usque.aut in quo imperium tuum.

What are spamtraps?

In short, spamtraps are bad addresses that you don’t want on your list. They’re old email addresses that haven’t been used for real people for a long time, or addresses that are put out to ensnare bad guys who are obtaining addresses in ways other than opt-in.

If you have spamtraps on your list, you’re going to be labeled a bad sender and blocked as a spammer. That’s why it’s important that you have good signup process to prevent fraudulent signups, and good bounce processing so that you expire out invalid addresses before an ISP would ever turn them into spamtraps.

For more about spamtraps, check out my recent blog posts on the topic (part one here and part two here), where I talk in detail about what they are, how they end up on your list, how you prevent them from getting there, and how to clean your list and get rid of spamtraps in the process.

Spamtraps are addresses that drive you directly into ISP spam filters and anti-spam blacklists. Consider them the express route to having your email blocked. Stefan Pollard recently wrote an excellent article on the topic of blacklists for ClickZ (find that here). Since many blacklisting issues are spamtrap-driven, there's great overlap between best practices on how to keep your list clean and what you should be doing to prevent and remove spamtraps.

On the Glossary page of anti-spam blacklist group Spamhaus, you'll find their definition of "spamtrap," one that I find generally to be accurate.

Dealing with spam to your abuse desk?

Among other things, I run the abuse desk for a large service provider with lots of clients. We get a handful of complaints a day. For example, over the past three days, we’ve received about sixteen complaints. And about two hundred spams.

The “fun” part of our job (for various values of “fun”) is going through the abuse mailbox and separating the wheat from the chaff every day. More than 90% of that inbound mail stream is spam. Just random, stupid spam emails from people dumb enough to send spam to an abuse desk. We take turns taking out the trash, moving this mail out of the way so that we can focus on the actual, actionable reports that need to be reviewed and investigated.

How can I reduce the amount of spam our abuse desk receives? I’ve used a lot of different blacklists over the years to reduce the amount of spam received. Problem is, most of them have some level of false positives associated with them. I don’t ever want to knowingly reject a complaint from somebody trying to report abuse from one of our users.
Time to do a bit of testing. On February 2nd, I wrote a script that tags all inbound mail sent to our abuse desk. The sending IP is checked against the Spamhaus ZEN combined list. If the sending host is on the ZEN list, our script adds [SPAM] to the subject line. This helps us sort the mail faster. We spend less time looking at the mail with [SPAM] in the subject line, and more time reviewing the mail that isn’t tagged.
Reviewing the over 2,200 spams I’ve received to our abuse desk from February 2nd through today, Spamhaus has successfully tagged 79.3% of them as spam. I’m very happy with that rate – this correct classification significantly reduces the amount of spam I have to deal with in the long term.
But what about false positives? Since I’m tagging mail, and not rejecting it, it’s very easy for me to find and note false positives. (A false positive in this instance would be a spam report that I wanted to receive, but might have missed because it was tagged as spam.) To date, I haven’t had a single false positive! I’ve saved all the mail in question, and reviewed it multiple times, looking for mail that I might want, but could have missed previously. There doesn’t seem to be any. Score another point for Spamhaus!

If you run an abuse desk that gets a lot of spam, how do you deal with it? I’d love to hear your thoughts. And if you’re in the same boat as me, and wondering what to do? It might be worth your while to tag the mail with Spamhaus ZEN. I think you’ll find that it’ll correctly identify most of the spam, and that false positives, if any, will be few and far between.

The Changing Definition of Spam

Over on CIO Magazine's website, capable jounalist Esther Schindler posted an interesting article on the topic of spam defined, and how that definition has been changing over the years. The spark that led to her writing this came from a discussion on an anti-spam mailing list we're both members of, and it was a topical discussion that I myself delved into.

I perhaps don't agree with her conclusions 100%, but I credit her for tackling a tough topic, and stirring up discussion and debate. It is true that the definition of spam is changing. It's also true that there's a hard-core group of anti-spam advocates who are resisting this change. Anti-spam mailing lists are sliding from the center out to the edge of the anti-spam universe; they once were the core and forefront of development and discussion relating the latest anti-spam technology, blocking tools, best practice methodology, etc. Nowadays, that's all shifted away, to discussions internal to ISPs and industry groups, spam filtering device manufacturers, and other areas, far from the view of the folks who used to call for "heads on pikes" as the only reasonable response to a single piece of (perceived) spam received.

To me, it highlights that the world is changing, and the Linux users with their access control lists don't hold the keys to the inbox like they once did.

What it does it mean “We do not relay?”

Have you ever received a bounce message that says “We do not relay” or “Mail loops back to myself”? Wondering what that means? I get this question often enough, that I thought it would be useful to break it down for you here.

Both of these error messages mean that the site you’re trying to send mail to is misconfigured. Neither of these errors typically indicates a problem with you or your ISP.

We do not relay” (or "Relaying denied") means “It looks like you’re trying to relay mail through me, and I don’t allow that.” In this instance, the destination mail server is incorrectly configured. It doesn’t know that it’s supposed to handle mail to the domain you’re contacting, so it’s thinking that it’s being asked to forward mail on for an unknown party. Most mail servers don’t allow this, because “open relaying” was a popular method of sending spam for many years. This doesn’t mean you’re a spammer. It just means that the remote server is configured incorrectly. They are probably (accidentally) blocking all inbound mail due to this issue.

Mail loops back to myself” is a similar issue. In this case, the mail server is smart enough to have looked up the MX (mail exchange) records for the remote domain. It notes that it in fact is the destination server for the mail. But, it hasn’t been configured to receive mail for this domain. So, the server is telling you, “I know that mail to this site is supposed to end here, but I’m not configured for that, so I don’t know what to do with this mail.” This is another example of an error message that probably indicates that all mail to that site is being bounced, because their server is not configured correctly.

If the server can tell that DNS records indicate that it’s supposed to accept mail for a given domain, why doesn’t it just automatically accept the mail? A mail server wouldn’t automatically accept mail for domains pointed at it via DNS, because that would be a risk to the server’s security and stability. Bad guys all around the world could point their MX (mail exchange) record toward a server, and the server could then be overwhelmed by mail its administrators didn’t ask for and don’t want.

Got any other questions about bounce messages and what they mean? Feel free to contact me, and I’ll do what I can to help.