Automatic white-listing from *outgoing* email

Vernon Schryver vjs@calcite.rhyolite.com
Wed Jan 1 16:45:24 UTC 2003


> From: "Arik Baratz" <arikb@vidius.co.il>

> What happens if we sniff outgoing email, and automatically
> white-list the destination?
>
> This will prevent replies to outgoing messages from being blocked, will
> automatically white-list mailing lists if the sender actively participates...

The input addresses of mailing lists often differ from their output
addresses.  For example, how would an automatic whitelisting mechanism
know from a message to dcc@rhyolite.com that it should whitelist
dcc-admin@rhyolite.com?

> Assuming that what is considered 'outgoing' is non-malicious in
> the spam-war context.

That assumption is fine for small mail systems where all of the users
are well known, but it is difficult at a large ISPs.  At least one
large organization is (or was) using the DCC only on outgoing mail to
detect and throttle its own spamming users.

Filtering by the DCC is not perfect.  What if a user responds to spam?
Responses to spam are amazingly common.  Because the blacklist at
http://www.rhyolite.com/anti-spam/spammers.html is indexed by search
engines, I receive strange messages.  Most such messages are requests
that I remove unsubscribe them, but yesterday someone asked about
software to copy DVDs to CDs.  For every user that thinks a blacklist
is a way to contact spammer, there must be many more who contact spammers
directly.

All that asside, if automatic white-listing would work for you or others,
then please feel free to implement it.  One way to build it would
be to modify the local mail user agent to add pairs of lines to the
whiteclnt file.  The first line would be a comment starting with
'#' with the date of the addition and the second would be meat.  Then
run a weekly or cron script that would delete entries older than 90 days.
The same script could search system logs for entries concerning mail
from white-listed sources and refresh the dates.


Vernon Schryver    vjs@rhyolite.com



More information about the DCC mailing list

Contact vjs@rhyolite.com by mail or use the form.