Amayita ([info]amayita) wrote,
@ 2007-02-02 20:33:00
Previous Entry  Add to memories!  Tell a Friend  Next Entry
Current mood: aggravated

Sender verify callouts *are* evil
Steinar H. Gunderson wrote:
> Who the heck is “uceprotect”, and should anyone care?
> At least they obviously don’t have much idea how sender verify works,
> as you can see from their page on the issue...

Well, as I can’t properly or reliably communicate with the Debian project via email anymore, I was about to allow sender verify probes on my side, but after reading what the Postfix project has to say about it, together with the “uceprotect” people, who look quite harsh, but otherwise reasonable to me... I say no way. Who the heck is “postfix”, and should anyone care? At least they obviously have a clue about how sender verify works, as you can see from their page on the issue...

I am sick of changing configuration in my (otherwise) almost perfectly working smtp server, specially if I am opening my postfix server to a potential DoS. From the link above:

The sender/recipient address verification feature described in this document is suitable only for low-traffic sites. It performs poorly under high load and may cause your site to be blacklisted by some providers.

Is Debian a low-traffic site? I am feeling cut out from the project, as I can no longer email certain (not all) developer@debian.org accounts, bug numbers in the BTS (control still works), and Alioth mailing lists. I refuse to misconfigure my email server because of this. This is plain stupid!

Greylisting was a minor nuissance. This is $FILL_IN_WITH_CURSE_OF_CHOICE:
~-root@aenima>mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
A57EB890041 1173 Fri Feb 2 19:52:34 xxxxxx@amayita.com
(host lists.alioth.debian.org[217.196.43.134] said: 451 Could not complete sender verify callout (in reply to RCPT TO command)) xxxxxx-pkg-base-maintainers-request@lists.alioth.debian.org
Spammers have already won. I hereby proclaim email officially dead.

(9 comments) - (Post a new comment)


[info]sfllaw
2007-02-02 09:57 pm UTC (link)
Sender address verification is terrible. I haven't a clue why people do stuff like this, especially with tons of e-mail servers out there that blindly accept e-mail.

(Reply to this) (Thread)
Sender address verification
[info]amayita
2007-02-02 10:55 pm UTC (link)
Looks like I was postgreying debian server's sender address verification. Antispam endless loop...

But it should noty be happening, as debian hosts come whitelisted by default!

/me scratches head

(Reply to this) (Parent)
Sender verify callouts OK for whitelist of domains
(Anonymous)
2007-02-03 05:51 am UTC (link)
We (svcs.cs.pdx.edu, aka psas.pdx.edu and other domains) use sender verify callouts, but *only* for a whitelisted set of domains. Specifically, we check PSU's own domains to handle the spammers that use fake addresses in the same domain, and we check a few webmail and similar providers whose addresses often get used for spam. In all cases, the domains we permit handle the callouts in the way we expect, and don't blacklist our server for doing them. In all other cases, we just use a typical spamassassin setup.

(Reply to this)

Greylisting and Sender Verify
(Anonymous)
2007-02-03 12:59 pm UTC (link)
Postgrey will eventually work with sender verify, as you got a "4xx" error, when it retries, eventually the sender verify should work, as it has now passed greylisting.

However it highlights one of the core problems with sender verify, which is it assumes the receiving server is available, and has capacity and willingness to respond, which if it isn't the sending servers (or worse, had its domain faked by the sender, like the vast majority of email does these days) is a rash assumption.

Should say Yahoo users not be allowed to email Debian, because their servers are often uncontactable due to spam load?! Seems a tad harsh, to both deny them service, and add to their load problems at the same time.

It is possible to stop spam (for all practical purposes) with greylisting, block lists, and other simple checks. It might need the Debian folk to talk nicely to the folk at Spamhaus or somewhere, but it isn't rocket science.

(Reply to this) (Thread)
Re: Greylisting and Sender Verify
(Anonymous)
2007-04-24 08:54 am UTC (link)
Sender verify by callouts can be configured to treat 4XX errors or MX unavailability to be treated as "OK/pass" (Don't know with postfix, exim can do it). So problems with greylisting are no argument against callouts.

(Reply to this) (Parent)

[info]andor
2007-02-05 11:52 am UTC (link)
I feel like beginning a vigilante crusade against spammers... A bunch of thousands € for visiting the top 5 spammers and cutting some heads and... ¡badabúm! :D --> 80% less SPAM in the world, 50% less traffic :D

(Reply to this)

(Reply from suspended user)

(Reply from suspended user)
FEATURE(`greet_pause', `35000') defeats debian.org
(Anonymous)
2008-10-10 01:10 pm UTC (link)
Same rant: I have a 35 second delay before offering a SMTP banner. The STUPID STUPID sender verification code at debian.org VIOLATES the SMTP standard, and tries to send commands before the greeting. My server tells it to get lost. It then refuses to accept the mail. Try again later for a week.

This is wrong. Sender verification can ONLY prove that an address does not exist. It cannot verify that an address does exist, unless it properly implements the complete SMTP protocol. Inability to complete sender verification CANNOT be a permanent error - but to debian.org it is.

  • Oct 10 13:52:29 pizza sm-mta[24483]: m93CoBf2004481: to=<weaselxxxxxxxxxx@debian.org>, ctladdr=<andrewxxxxxxxxxxx@lunch.za.net> (1961/100), delay=7+00:02:14, xdelay=00:01:03, mailer=esmtp, pri=90935452, relay=master.debian.org. [70.103.162.29], dsn=4.3.0, stat=Deferred: 451 Could not complete sender verify callout
  • Oct 10 13:52:29 pizza sm-mta[24487]: m9ACpxTQ024487: rejecting commands from master.debian.org [70.103.162.29] due to pre-greeting traffic

    (Reply to this)

    • (9 comments) - (Post a new comment)

    Create an Account
    Forgot your login or password?
    Login w/ OpenID
    English • Español • Deutsch • Русский…