Lotus Notes Spam

12 - I disagree. Spam filters can be very effective if we know how to use them. I personally suggest spamhaus.org

It is a very good DNS BL site.

11 - I took your advice and removed my DNS Blacklist filtering. I immediately started receiving dozens of rejection notices from undeliverable mail - that I had never sent! This means that my email address is being spoofed - not unusual these days - but I don't want to delete these spurious emails all the time. My Blacklist is back on.

10 - There are many (hundreds?) or DNS blocklists. Some are responsible, some list everyone and the kitchen sink.

Anyone who use DNS blocklists need to be sure they know the listing and delisting criterial for each. And keep up with information, and not use old lists that list the whole IP4 space (i.e. like ORBS did the other day).

I am not aware of any reputable lists that charge for removal. Some charge a fee for manual/expedited removal (I think UCEPROTECT is asking for 50 euro to cover the cost for early removal), but normally you get delisted after you taken care of the issue that caused you to be listed.

Lists like ASPEWS are not (or should not be) used outside pure hobbyist systems, if even there. But Spamhaus ZEN is a great list.

The biggest benefit with dropping the connection at the SMTP level (using a DNS blocklist) will save a ton of work for the server. Most studies show (IIRC)that properly implemented DNS blocklists stop about 80-90% of the spam. Since spam is 90% of the traffic today, we are talking about a reduction in work for the Domino server/SpamSentinel software of 70-80%. So if you today recieve and process 10,000 email a day, you are looking at processing (and potentially storing in a quarantaine folder) about 40,000 email. Quite a difference.

@Frank Harris in #7: I am not aware of many companies being blacklisted by the big/reputable blocklists without reason. In most cases there are actually good reasosn, like backscatter, zombied computers that actually do send out spam, or using a "dirty" provider.
It is also easier to get out of a handful of public blocklists than thousands of private lists, and there are tools that let you check if/where you are listed. Is there a tool that let me check if I am blocked by SpamSentinel? Or is SpamSentinel sending back a bounce for blocked mail? That could be backscatter and cause the customer to be listed at backscatterer.org, for example.

@Jerome in #8: Which blocklists are forcing you to pay "a lot"? None that I know. I know USEPROTECT charge 50 euro if you don't want to wait the 7 days they normally use for delisting. See that as a waiting period similar to when you buy a handgun, you have to wait for a certain number of days before you get to buy the gun, so that background checks can be performed...
Also, you say "a few people without public procedures pass judgments that are near impossible to appeal".
If the lists are bad, people will not use them. So it is a self-regulating process.
In most cases you don't need to appeal, you just fix the problem. I am (somewhat) active in nanae (news.admin.net-abuse.email) and read alot there and in the moderated sister group nanabl (news.admin.net-abuse.blocklisting). I see very few complainers that actually have a valid point. In most cases they are hosted on bad/spam friendly networks, and very few are actually listed in blocklists than are used.

9 - I agree with one exception. Blacklist can produce false positives but really have positive impact on load. Especially when our SMTP server have limited bandwidth and ratio rejected/accepted messages is high as on our server (we have over 90% rejected connections). Then disabling DNS blacklist does mean that our load on line will be 10 times bigger which is of course unacceptable.

Until this general problem will not be solved we must stick to DNS blacklist. Is not acceptable to process 90% messages just for auto deleting on arrival.

I would like to see any solution where message is rejected before is processed:

- delay few seconds after initial HELO. Most bots won't wait and drop line
- reject message on invalid RCPT without sending non-delivery report

8 - Great job franck, thanks for all clarification to Domino/Notes users. It is not Domino job to do that. Plus managing personal blacklist is really easy but using public blacklist can become instable (many IP ranges can be blacklisted and you cannot take that range ut of the blacklist site without paying a lot.
Also Domino is using DNSBL such a way that if all BL are down, you do not receive mails anymore.

7 - As with all systems, Email filtering is in a constant state of evolution. I agree with Frank's presentation. I have had multiple clients that were Blacklisted for no definable reason, and the removal process was painful.

Email is now a critical part of any business, and failure to receive that one Email could mean the loss of an opportunity. Even more critical is the negative stigma presented to others because you are "on the list".

Good job Frank.

6 - I am glad you stepped up and criticized black lists. Conceptually such lists make sense, but the implementation is flawed: a few people without public procedures pass judgments that are near impossible to appeal. Unlike dictatorships this is done with good intent, mind you. Alternate DNS approaches (reverse, SPF, etc.) and deeper message-based analysis is the only safe way to filter spam in my opinion.

5 - We run all our servers with spamhaus for a DNS blacklist and reject the message. I can't imagine running a mail server today without it. Is the new version of SS rejecting connections similar to how Domino blocks connections in a DNSBL? If so maybe we should consider that. If not then we'd need to throw more hardware at it just to process all the spam! For the very few false positives we've seen, the benefits of using the DNSBL far outweigh the problems caused, in my experience.

4 - Hi Frank, Thank You very much, but what about DNS Whitelists?

3 - I disagree, at least partly. When using a blacklist through the Domino config, messages are dropped during the smtp transfer. This means that your mail server will never take responsibility for the message and its up to the sending mail server to let the sender know it didn't go through. It also cuts down on the mail you take into your system in the first place. DNS blacklists should defiantly be used with caution, but rejecting mail during smtp transfer is the way to go!

2 - I've only use Spamhaus with your software and no problems until now.

1 - totaly agree, using DNS blacklist will be a ticket for troubles with customers.