[postmaster@blackhole.com: Unsolicited commercial email rejected]

Mon Oct 13 18:31:26 IST 2003

David,

thanks for your comments:

> However, there are still a few basic rules of email systems that should not
> be broken without very good reason. One of these is that no email should be
> silently deleted. During normal operations that means, for instance, that if
> your friend's domain name expires you get notified that your emails to them
> were unable to be sent.

Ok, but then the headers of the original email should be provided as they
allow the second victim to track down the culprit. Every bounce generated
by the usual mail servers includes the headers.  Mailscanner omits them.

And there is still another way to avoid the problem you are mentioning.
Do not delete the incoming spam but deliver it into a separate folder
with an automatic deletion of all emails that are older than several
days. This gives the recipient of the spam the opportunity to check
for false positives himself from time to time. If you do this, you are
neither dropping the spams on the floor, nor annoying innocent people
with the notifications. I use this technique myself.

And if you do not agree with this, then you still could consider some
opt-out methods for innocent recipients of these messages. This could
be done, for example, by the inclusion of special headers. Then it still
hits my mail server but not my mail box if I add a special filter for it.

But the best method is still the rejection of incoming spam messages
during the SMTP session. You are perfectly free to return an
``554 This looks like spam to us. Sorry'' after seeing CR LF dot CR LF.
And if you need some time for analysing the email, you are free to
hold the line by using continued lines (i.e. by giving a ``-'' after
the three-digit code) as it is done in case of teergrubes.

If this issue continues to be ignored by developers and users of
Mailscanner or similar software, it is just a matter of time until we see
the first RBL lists for mail servers sending Mailscanner notifications.

Andreas Borchert
http://www.andreas-borchert.de/

> In the case of spam detection systems we do have a special case in that many
> of the spams are not addressed from the spammer but from an innocent 3rd
> party. However, there is still a chance (although the folks with Mailscanner
> do a good job of minimizing it) that a legitamate email that is not spam
> would get flagged as spam. In this case it is a very good thing that our
> installation of mailscanner is configured to bounce a message back.
> Otherwise the email would get silently deleted and break the email system
> standards. It is the email standards that are in place for very good reasons
> that the email system works the way it does.
> 
> -David Price
> Support Department
> BHI Advanced Internet Solutions
> http://bhi.com
> 952.361.5557
> 
> -----Original Message-----
> From: Andreas Borchert [mailto:mailscanner at andreas-borchert.de]
> Sent: Monday, October 13, 2003 6:33 AM
> To: Julian Field
> Cc: dave.perrill at black-hole.com; abuse at black-hole.com
> Subject: Re: [postmaster at blackhole.com: Unsolicited commercial email
> rejected]
> 
> 
> Julian Field,
> 
> thanks for responding:
> 
> On Mon, Oct 13, 2003 at 10:54:51AM +0100, Julian Field wrote:
> > How very polite :-)
> 
> Please excuse me for using clear language but I am really tired to see
> so many of these false spam notifications. And this notification was in
> no way polite either.  I haven't sent the spam. And the authors of this
> software most likely knew that most if not all [1] recipients of these
> messages haven't sent the spams either.
> 
> > Please read
> > www.sng.ecs.soton.ac.uk/mailscanner/reject.html
> 
> I have read this before. This does not address my problem. I haven't
> sent any messages to those who sent me the notification (before). Neither
> spam nor anything else.
> 
> > It sounds as if your email address is being used by a spammer as a fake
> > "From:" address in mail they are sending, so that you get the bounce
> > messages and not the spammer.
> 
> Indeed, this is the problem as I have explained in my response.
> 
> > If you had been rather more polite in your mail, I would feel rather more
> > inclined to explain this in detail. But you weren't, so I'm not.
> 
> And you think this is polite when you suggest I do not understand the
> technicals issues, needing technical explanations from you?  It is
> perfectly clear for me how this message was generated. It is even
> explained in my message.
> 
> Do you really want to let me assume that you do not see the consequences
> of your software? That you are going to destroy the mail infrastructure
> which is currently aggressively targeted by spammers to an even greater
> extent by flooding innocent victims with absolutely useless messages? And
> do you really fail to understand that such messages are particularly
> useless if they do not provide the headers?
> 
> Sigh!
> 
> See, any system that automatically sends emails should do this in
> a responsible way, i.e. the recipient should be related either to
> the institution sending out the email or to the email the system is
> responding to. If you send emails automatically to people who never had
> any contact with you before, then your system is generating unsolicited
> emails. This is as bad as the original spam. Not everything which claims
> to fight spam is a good thing, in particular not if it itself generates
> unsolicited emails.
> 
> Do you have ever thought about the people receiving these messages?
> Should I silently accept and delete them? Or should I fight them like the
> original spams themselves? My mailbox is currently primarily flooded with
> such notifications because most of the regular spam is already sorted out.
> 
> Please think about the implications of the Mailscanner software.
> 
> Andreas Borchert
> http://www.andreas-borchert.de/
> 
> [1] Please show me a spam that you got in recent times with an envelope
> sender that points to the real sender. It is pretty hard to find
> such cases.
> 
> >
> > At 10:35 13/10/2003, Andreas Borchert wrote:
> > >Hello,
> > >
> > >today I received the attached message from a network of black-hole.com,
> > >apparently using some software distributed by mailscanner.com.
> > >
> > >It falsely claims that
> > >
> > >   ``Our UCE (spam) detectors have been triggered by a message you
> > >   sent:- To: stuart at acutekplastics.com, sue at acutekplastics.com,
> > >   sunshine at acutekplastics.com, syso at acutekplastics.com,
> > >   ter at acutekplastics.com, terri at acutekplastics.com,
> > >   terry at acutekplastics.com, thomas at acutekplastics.com,
> > >   tina at acutekplastics.com, tj at acutekplastics.com, tom at acutekplastics.com
> > >   Subject: UNLIMITED LEADS juovduamm a
> > >   Date: Mon Oct 13 03:59:55 2003
> > >   This message has been rejected. The detector that triggered is
> > >   SpamAssassin.
> > >
> > >   The content of your message indicates that it is probably spam e-mail,
> > >   which is why it has been rejected.''
> > >
> > >I have never sent such a message. It should be common knowledge now
> > >that spams use faked sender addresses regularly. Sending out false
> > >claims like this is just simply annoying and helps nobody as you even
> > >fail to provide the headers of the email with the faked address.
> > >
> > >The distribution of such ``spam fighting'' software and its application
> > >are simply irresponsible. This piece of crap simply moves the spam load
> > >from the original recipients to another set of innocent victims. However,
> > >it is much harder to fight against the garbage you are generating than
> > >to fight against the original spam producers.
> > >
> > >Do you expect me to eat this garbage or should I block your networks
> > >like those of spam hosters? I hope that this can be avoided and that
> > >common sense returns.
> > >
> > >Andreas Borchert
> > >http://www.andreas-borchert.de/
> > >Return-Path: <>
> > >Delivered-To: afb-tbkrmde67 at andreas-borchert.de
> > >Received: (qmail 15733 invoked by uid 0); 13 Oct 2003 09:03:33 -0000
> > >Received: from mail.black-hole.com (216.185.192.6)
> > >  by mellifont.in-ulm.de with SMTP; 13 Oct 2003 09:03:33 -0000
> > >Received: from noc3.bhi.com (noc3.bhi.com [216.185.192.31]) by
> > >blackhole.com
> > > (Rockliffe SMTPRA 6.0.6) with ESMTP id <B0033854681 at mail.black-hole.com>
> > >for <tbkrmde67 at andreas-borchert.de>;
> > > Mon, 13 Oct 2003 04:06:16 -0500
> > >Received: (from root at localhost)
> > >        by noc3.bhi.com (8.11.6/8.11.6) id h9D8xto11273;
> > >        Mon, 13 Oct 2003 03:59:55 -0500
> > >Date: Mon, 13 Oct 2003 03:59:55 -0500
> > >Message-Id: <200310130859.h9D8xto11273 at noc3.bhi.com>
> > >From: "MailScanner" <postmaster at blackhole.com>
> > >To: tbkrmde67 at andreas-borchert.de
> > >Subject: Unsolicited commercial email rejected
> > >X-MailScanner: generated
> > >MIME-Version: 1.0
> > >
> > >Our UCE (spam) detectors have been triggered by a message you sent:-
> > >  To: stuart at acutekplastics.com, sue at acutekplastics.com,
> > >sunshine at acutekplastics.com, syso at acutekplastics.com,
> > >ter at acutekplastics.com, terri at acutekplastics.com,
> > >terry at acutekplastics.com, thomas at acutekplastics.com,
> > >tina at acutekplastics.com, tj at acutekplastics.com, tom at acutekplastics.com
> > >  Subject: UNLIMITED LEADS juovduamm a
> > >  Date: Mon Oct 13 03:59:55 2003
> > >This message has been rejected. The detector that triggered is
> > >SpamAssassin.
> > >
> > >The content of your message indicates that it is probably spam e-mail,
> > >which is why it has been rejected.
> > >
> > >We do not accept unsolicited commercial (spam) e-mail and actively
> > >work to stop it. If you are sending spam and continue to do so, your
> > >Internet Service Provider may be contacted and requested to close your
> > >account.
> > >
> > >If you have any questions about this, or you believe you have received
> > >this message in error, please contact the site system administrators.
> > >
> > >--
> > >MailScanner
> > >Email Virus Scanner
> > >www.mailscanner.info
> > >Mailscanner thanks transtec Computers for their support
> >
> > --
> > Julian Field
> > www.MailScanner.info
> > MailScanner thanks transtec Computers for their support
> >
> > PGP footprint: EE81 D763 3DB0 0BFD E1DC  7222 11F6 5947 1415 B654
> >
> 