f2s - Implementation of new outbound email controls

[richard_f2s]

The following will be posted to the freedom2surf status pages today:-

_______________________________________________

Outbound SPAM Controls

Between 10th and 12th December 2007 freedom2surf will be introducing additional controls on outgoing email sent through its outbound SMTP service. These controls are specifically designed to counter the growing number of outgoing SPAM messages on the freedom2surf email platforms. Using sophisticated content and reputation based analysis, this new addition to the f2s email platform, which has also been successfully implemented by Tiscali, has been proven to substantially reduce illicit spam.

This new system replaces the freedom2surf SMTP blacklist system which was introduced on 10th July 2006.

The implementation will be transparent to customers and no downtime is scheduled for this work. Customers should expect to see improvements in outbound mail handling almost immediately and all outbound emails queued on the current SMTP servers will be delivered before any changes are made.

We will update our Email FAQ on the 10th December - please check http://www.freedom2surf.net/help/emailtechfaq.php for further details.

__________________________________________________ ____

A draft of the updated FAQ which will go live next week is below:-

Spam Controls on Outbound email

* What controls do freedom2surf have in place to counter outgoing SPAM emai?

We employ a centralised content and reputation based system which monitors
outgoing email for messages which can be categorised as SPAM

* Why do we need this?

The problems created by users spamming (either intentionally or by virus) via our mail servers are well known:

o Blacklisting (eg SpamCop).
o Complaints from third parties.
o Excess load on the server (outgoing and incoming bounces)

Customer operated open mail relays or misconfigured mail servers have also caused performance issues by sending thousands of messages out to our mail platform.

* How does it work?

Each email sent via our SMTP service is checked using sophisticated 3rd Party content and reputation based analysers and if email messages are rated as being SPAM messages the originating email address will be sent a bounce message. This means that virtually all SPAM messages do not reach the outside world and the outbound load on our servers is reduced.

* I'm getting bounce messages on emails that I don't recognise, what do I do?

It is quite possible one of the computers in your network which is connected to the freedom2surf outgoing email servers has been infected with a virus.

You should immediately run an up to date virus check on these computers.

* I need to send legitimate bulk emails and these messages are bouncing, what do I do?

You will need to call our technical support team or log an issue via our web
based support system detailing your requirement and providing an example the non-SPAM email that you wish to send. Our support team will provide you with details of the alternatives available to you.

[Glasgow]

Originally Posted by richard_f2s

A draft of the updated FAQ which will go live next week is below:-

Spam Controls on Outbound email
* I'm getting bounce messages on emails that I don't recognise, what do I do?

It is quite possible one of the computers in your network which is connected to the freedom2surf outgoing email servers has been infected with a virus.

You should immediately run an up to date virus check on these computers.

It is always good advice to run an up-to-date virus checker, but is it not more likely that the cause of this problem is a spammer who has spoofed your e-mail address as the "source" or "reply" or both in the spammed messages? When the spam is caught by an effective ISP, a bounce rejection message is then sent to the apparent source. Some months ago I received hundreds of such bounced messages a day on my anyname@mydomain.org account when some spammers were spoofing on addresses at genuine ".org" domains.

Originally Posted by richard_f2s

* I need to send legitimate bulk emails and these messages are bouncing, what do I do?

You will need to call our technical support team or log an issue via our web
based support system detailing your requirement and providing an example the non-SPAM email that you wish to send. Our support team will provide you with details of the alternatives available to you.

I think it would be helpful here to distinguish between an identical message sent separately to many recipients (say 1,000 messages at one time) and one message addressed to many recipients (say 1,000 recipients) either in the "To" box or the "Bcc" box.
I have used both approaches to send an e-mail newsletter once or twice a week to around 2,500 addresses. Experience so far indicates that a significant, and perhaps growing, number of organisations have their e-mail network programmed automatically to block any message with even quite small numbers of multi-recipients in the "Bcc" box.

[j2fm]

This system isn't going to flag up instances where I forward/report received spam to abuse@spammersips.org by any chance, is it?

Jim

[aos101]

Originally Posted by j2fm

This system isn't going to flag up instances where I forward/report received spam to abuse@spammersips.org by any chance, is it?

Jim

I'd hope not. The email hosts for one of my domains now does spam checking on outgoing mail, and I got an error the other day when I was sending to an abuse@ address trying to report a spamming IP. It's really annoying when you're trying to help prevent spam that you get bitten by a system thinking you are spamming.

[Glasgow]

Originally Posted by richard_f2s

Outbound SPAM Controls
Between 10th and Th December 2007 freedom2surf will be introducing additional controls on outgoing email sent through its outbound SMTP service. These controls are specifically designed to counter the growing number of outgoing SPAM messages on the freedom2surf email platforms. Using sophisticated content and reputation based analysis, this new addition to the f2s email platform, which has also been successfully implemented by Tiscali, has been proven to substantially reduce illicit spam.

This new system replaces the freedom2surf SMTP blacklist system which was introduced on 10th July 2006.

Will this outgoing spam-check be consistently more reliable than the F2S spam-check on incoming messages?

I don't normally make any use of the F2S-Spam-Score (mainly because I receive very few messages on my fs2.com e-mail account), but the spam scores I have checked recently are jokes.

I found this information on the Spam Observations thread (but cannot find the original post from which this quote was taken):
Quote:
Originally Posted by richard_f2s
OK some clarification on ratings:-

The spam engine will provide a rating of between -30 and +30

-30 - certainly a real message
+5 - probably spam
+30 - certainly a spam message

So, negative numbers good, positive numbers mean an increasing likelihood that the message is spam.

Are these score limits still current? Today I received a valid message with an F2S-Spam-Score of 42. That message also carried a Cloudmark Score (used en route) of 0.000000.

So we must hope the new outgoing F2S spam-checker is somewhat better at doing what it is claimed to do than the F2S spam-checker for incoming messages.

[No Rest]

I take it this is the Spamhaus system Tiscali use? They had problems with it when they implemented it resulting in undelivered email for over a week. Tiscali said customers should accept that email is a free extra which was jolly nice of them!

http://www.theregister.co.uk/2007/06...l_spam_doubts/

[Old_Crow]

Anyone else noticed E-mails being sent out with corrupted headers since the switch to the Tiscali 'free extra' mail servers? I'm seeing my E-mail being delivered with blank date/time of send, and CC'd copies corrupted so that they appear to be blank despite being many K in size (the same size as the original, which is being delivered in a readable form). This is mail being sent out through my @domain.f2s.com addresses, which was migrated sometime today it appears.

[atsw]

Outgoing mail seems to be taking a long time to get to its recipients. I sent a message at 6:19pm this evening from the PC at home (via outmail.f2s.com) and still not received it at work yet (now 7:05pm). Now, could be a problem with the work mail servers of course, just have to wait and see.

Andrew

[atsw]

Actually, just double-checked the SMTP settings on the PC at home, and was actually sent via outmail.username.f2s.com. Still not arrived mind.

Andrew

[aos101]

I just sent a plain text email from an @f2s.com address and cc'd it to another address and both came through quickly (the cc'd email was fine). The date header looked fine also. My outmail.username.f2s.com address points at the same Tiscali server outmail.f2s.com points at, so I wouldn't expect using outmail.username.f2s.com to make a difference. Strange...

[atsw]

Mail arrived at 8:28pm. Looks like it got trapped en-route to my work address, not at Tiscali, but at the servers of 123-reg.co.uk, which seemed to hang onto the message for 2hrs before eventually passing it on to my work server for final processing to my inbox.

Ah, Pipex, don't you just love them!

Andrew

[atsw]

Originally Posted by aos101

I just sent a plain text email from an @f2s.com address and cc'd it to another address and both came through quickly (the cc'd email was fine). The date header looked fine also. My outmail.username.f2s.com address points at the same Tiscali server outmail.f2s.com points at, so I wouldn't expect using outmail.username.f2s.com to make a difference. Strange...

Just to confirm, once the message got to me it was correctly formatted and all the header information also looked fine.

Also, my outmail.username.f2s.com address points at the same Tiscali server outmail.f2s.com, i.e. smtp.f2s.tiscali.co.uk.

Andrew

[Old_Crow]

After wading through reams of E-mail headers, I think I can safely say that Tiscali's SMTP server setup makes a complete dog's breakfast of outgoing E-mail. Whereas the old f2s servers defaulted headers and supplied all the basic fields as necessary so that the interface was pretty seamless, Tiscali's version is a mess. In fact it even manages to use different basic headers on the same message depending on whether it's handling the To: addresses or the CC: copies.

Suffice to say that the results you get are now very much dependent on the E-mail Client used to send a particular mail item. In particular light-weight clients such as network boxes, Perl scripts etc. are now likely to generate pretty poor looking outgoing mail items. I'll try to post some examples of the mess Tiscali servers make compared with the old f2s servers when I get a chance.

Definitely time to get my MAC if this is what Tiscali thinks is an 'adequate' E-mail service. Seems we should be grateful if it works at all...

[Glasgow]

I am disappointed to note the lack of response to the very specific questions and comments in my two posts above, both dated 7 December.

[Karl Prince]

Some replies, though please note I do not work for F2S

Originally Posted by Glasgow

It is always good advice to run an up-to-date virus checker, but is it not more likely that the cause of this problem is a spammer who has spoofed your e-mail address as the "source" or "reply" or both in the spammed messages? When the spam is caught by an effective ISP, a bounce rejection message is then sent to the apparent source. Some months ago I received hundreds of such bounced messages a day on my anyname@mydomain.org account when some spammers were spoofing on addresses at genuine ".org" domains.

Many issues in one here, no quick one line reply is possible:

• My understanding from the F2S post above is that they are going to reject spam from F2S customers connections (which may have a virus). How tied this is to that connections valid email accounts, so that the bounces go to the correct from address is not clear. Unless the spam is rejected during the SMTP connection phase I can see this being problematic, though hopefully the bounces do not escape the F2S network either adding to backscatter bounce spam.
• Nowadays only a few ISPs and companies mail servers accept an email only to reject it later as spam, then send a bounce to the (probably forged) sender address. This is reflective spamming, and I consider the owners of these email servers to be part of the spam problem, not the solution.
• A sudden surge in spam email bounces is probably the result of an address being forged, particularly if that address already gets spam. As most people can not (accurately) parse an email header, it still worth checking for infections and security settings if running a server.

Originally Posted by Glasgow

I think it would be helpful here to distinguish between an identical message sent separately to many recipients (say 1,000 messages at one time) and one message addressed to many recipients (say 1,000 recipients) either in the "To" box or the "Bcc" box.
I have used both approaches to send an e-mail newsletter once or twice a week to around 2,500 addresses. Experience so far indicates that a significant, and perhaps growing, number of organisations have their e-mail network programmed automatically to block any message with even quite small numbers of multi-recipients in the "Bcc" box.

The Bcc blocking has been happening for many years. If you are having issues mailing out, I suggest you contact support as indicated in the post. If this does not work out, you may need to set up an outbound only mail server (this requires some work on the DNS and PTR records, for which I have posted about previously)

[Glasgow]

Thanks for your comments, Karl.

Originally Posted by Karl Prince

Nowadays only a few ISPs and companies mail servers accept an email only to reject it later as spam, then send a bounce to the (probably forged) sender address. This is reflective spamming, and I consider the owners of these email servers to be part of the spam problem, not the solution.

I have no idea whether these "rejected as spam" bounces are now sent out by only a few ISPs and companies, but when the storm happened, they arrived in their hundreds and from all over. None now for several months.

No-one wants an increase in unnecessary e-mails, but the issue of "reflective spam" has been used by F2S as their excuse for not implementing a "virus trapped and deleted" notification system. The ISP through whom I receive most of my e-mail (Globalnet, now part of Madasafish) blocks and deletes messages containing known viruses, but they send me a message to say what virus has been intercepted and give me the e-mail address of the apparent sender. As most of these infected messages are malware, I take no action on most of them. But on the occasion when someone I know appears to have been the source, I inform them by forwarding the Globalnet auto-message. F2S has refused to implement such a system. (F2S could also learn from Globalnet about how to deal within incoming spam, but again, they won't listen.)

Originally Posted by Karl Prince

A sudden surge in spam email bounces is probably the result of an address being forged, particularly if that address already gets spam. As most people can not (accurately) parse an email header, it still worth checking for infections and security settings if running a server.

Yes, the sender's address was being forged by the spammers. The point in my original post was to question whether this was not the more likely source than a virus infection of the receiver's computer as suggested in the FAQ. Just for the record, the addresses involved (of the form "name@domain.org", including a catch-all for misspelt names), have received very, very little spam over the past seven years despite being widely publicised, and no e-mail server is involved at my end. The ISP for these addresses is GreenNet and they do seem to run a tidy ship.

Originally Posted by Karl Prince

The Bcc blocking has been happening for many years. If you are having issues mailing out, I suggest you contact support as indicated in the post. If this does not work out, you may need to set up an outbound only mail server (this requires some work on the DNS and PTR records, for which I have posted about previously)

I do not use my F2S e-mail account to send out my 2,500 messages at a time, but in my post above I suggested it might be helpful to clarify the FAQ to distinguish between "bulk e-mail", i.e. one message sent to hundreds or thousands of addresses in the To, Cc, or Bcc box, and a "bulk e-mailing" in which hundreds or thousands of identical messages are sent separately to each address one after the other, just as fast as the system will handle them. For reasons not related to F2S, I now send my weekly 2,500 as separate messages - takes 30 - 40 minutes to clear the Outbox.

Your mention of DNS and PRT records raises a wry smile here. I don't run an e-mail server, but I had to create DNS and PRT records for my F2S STATIC IP address when SORBS listed a vast block of F2S IP addresses as dynamic and sources of spam. I was having problems with sending e-mail through an overseas ISP because my IP address was listed in the SORBS database. SORBS would not de-list me until I could provide the DNS and PRT records to show that my IP address really was static (for which I used Findhere.org).

[Karl Prince]

Originally Posted by Glasgow

Your mention of DNS and PRT records raises a wry smile here. I don't run an e-mail server, but I had to create DNS and PRT records for my F2S STATIC IP address when SORBS listed a vast block of F2S IP addresses as dynamic and sources of spam. I was having problems with sending e-mail through an overseas ISP because my IP address was listed in the SORBS database. SORBS would not de-list me until I could provide the DNS and PRT records to show that my IP address really was static (for which I used Findhere.org).

Wry smile indeed, it was me who took you through the process... SORBS, Dynamic Addresses & the F2S debacle.

If there is an issue that personally effects you with F2S mail policy, then you should raise a support call.

As for the rest, probably heading well off topic now...

[Glasgow]

Originally Posted by Karl Prince

Wry smile indeed, it was me who took you through the process...

Thanks again for that.

Originally Posted by Karl Prince

If there is an issue that personally affects you with F2S mail policy, then you should raise a support call.

The point of my two original posts was:
1. to suggest two clarifications to the FAQ that I thought would be helpful, and
2. to ask two questions, one about about the reliability of the F2S spam scores on incoming messages, and based on that experience, the other about the reliability of the new out-going spam-check because experience of the incoming spam-check system, sadly, does not inspire confidence. I do use my f2s.com e-mail account, but nothing like as much as I use my e-mail accounts with three other ISPs although F2S provide my broadband conenction to them all.