Re: Domain reputation

From: Mauricio Tavares <raubvogel_at_gmail.com>
Date: Thu, 9 Jun 2011 15:03:47 -0400

On Thu, Jun 9, 2011 at 2:08 PM, Alessandro Vesely <vesely_at_tana.it> wrote:
> On 09/Jun/11 00:48, Murray S. Kucherawy wrote:
>> What I believe domain-level reputation is better for doing is
>> identifying sources of good mail, and giving them preferential
>> treatment.
>
> Yes, whitelisting betters communication latency due to greylisting,
> and can help avoid false positives.  The question is how an MTA
> measures the "whitelistability" of signing domains.  Perhaps domains
> that users often choose as targets, and seldom compare in
> abuse-reports are good candidates for whitelisting.
>
      Should that be used for white/blacklisting or more as another
spam filtering weight/score?

>> And, as a final point, the set of "good" domains isn't affected by
>> filters that reject spam or bad IP addresses, because they aren't on
>> that list anyway.
>
> OTOH, a server might get on a DNSBL by accident, e.g. because it
> shares a NAT address with a spammer.  An MTA who whitelisted such a
> domain based on its internal measurements, can still accept their
> mail, despite the blacklisting, if it wants to.
>
> Of course, organizations running multiple MTAs are expected to
> configure whitelisting coherently.  Thus, they may want to implement
> an internal reputation-query protocol.  However, sharing reputation
> data across different organizations may pose some semantics questions,
> similar to the before-or-after-RBL-filtering discussed recently on
> this list.
>
>
>
Received on Thu Jun 09 2011 - 19:04:00 PST