Order of the Bath

There are a number of systems around which try to verify the sender’s email address before passing the incoming mail onto you. One of the popular ones is Challenge-Response. What it does is work with a whitelist of known email addresses. If the mail comes from one of these it passes it into your inbox. Fine. If it comes from an unknown address then it doesn’t just delete it, which is good, but it sends back an automated reply to the sender asking them to verify that they really did send the email in the first place. This sounds good; what happens is the person who wrote to you has to reply in a particular way or visit a web site to verify their address and then the original email is passed into your inbox. However if the email came from a spammer then they won’t reply and you will never see the original mail.

What is wrong with this; I am getting the mail I want and not getting the spam?

There are a number of answers to this. Firstly, you are making your correspondents jump through hoops just to write to you. Of course you will have put all your known correspondents into your whitelist already but that unexpected enquiry from someone who has read your blog, or auntie Jean who has just got an AOL account or a friend who has had to change providers will have to perform unnatural acts. Auntie Jean may never figure it out. Do you mind if you never receive the receipt from that widget you bought online.

Secondly, if you are a member of any mailing list, what happens if someone new joins. Their first mail goes to the list which is passed on to you. Your system replies asking for validation—but he has never heard of you. Worse still, your challenge may go to the list for everyone to see.

Third, what if the sender is using a similar system, what happens to your response (exercise for the reader).

Finally, and most importantly, it makes YOU a spammer. All those challenge replies you send, an equal number to the spam you receive, contribute to the network load. And where do you think they are going? Not to the spammer because he was careful not to put his own address on it; the return addresses are all forged, and a good percentage of them will belong to real users who not only get their normal ration of spam but are now also getting yours as well. And don’t think your ISP won’t notice either. They are used to large volumes of incoming mail because they know about spam but suddenly you are generating large volumes of outgoing mail as well; and they know about spam so are liable to cut you off.

My hosting company are trialling a central spam blocking option on my domain. Actually it is a marketing exercise to get me to buy it but it was interesting enough to accept. It is a reputable system using Barracuda which incorporates a rule based algorithmic scoring system with user whitelisting and blacklisting plus, after a while, a Bayesian component. It is all web based and quite easy to use and seems to be effective.
The reason I won’t be continuing after the trial is that I now get as many “quarantine” messages from the system as there used to be spam and I have to read them. The reason is subtle and one that they didn’t think of.
One of the “features” of own-domain email is that you have the potential of a nearly infinite number of email addresses. The hosting people encouraged this by providing a “nobody” facility—a mechanism that sends any mail for which there isn’t a designated box or alias to a single address. I exploit this by giving every (organisation) that I deal with a unique address when I sign up; e.g. for mailing lists, payment accounts etc. That way I can tell if they forward it to “partners” or sell their address list. It has only happened to me once but was useful to prove the case.
A side effect of this is that if a spammer does a random name type of attack then I get it all in my inbox, not a huge amount but enough to notice. Unfortunately the new spam block system doesn’t recognise this so opens a quarantine management box for every new address it sees and sends me a summary and a password for it.
What it ought to do is activate the forwarding rules BEFORE processing the mail, then I would only get one box for the whole lot and it would start to get a significant amount of data for the Bayesian algorithm to kick in—but I can’t convince them of that so I will continue to process my own spam. Popfile is good enough and there is no bandwidth problem.