On Monday 13 February 2017 18.09, Richard Clayton wrote:

In message <201702131743.10508.peter@hk.ipsec.se>, peter h <peter@hk.ipsec.se> writes

...

The very simplest thing to do is make sure any outbound smtp is relaye through the ISP's mailrelays, where spam could be detected and subsequently blocked.

this is very unpopular with legitimate businesses who wish to be fully in control of their email sending destiny -- and ISPs generally do not wish to discourage the people who cause no trouble and pay their bills regularly and on time

so although "port 25 blocking" is a M3AAWG Best Practice it has not been widely adopted with the main (but not only) exception being the large consumer ISPs in the US (ISPs in Europe have, for historical reasons, had a significant number of business customers mixed in with pure consumers and that has made the difference)

There is not any req that all customers always should be forced to use ISP relays, the default behaviour might be to use ISP relays, and to have DHCP given address. But for an extra service one could obtain a fixed address, and as extra service, use port 25. The main point is to have those "unaware" users, whos computers might be stolen, prevented. They won't notice, and they don't get harmed. Spam from a fixed ip or range is much easier to detact and correct then spam from any box that happens to get an DHCP lease. Flexibility and service is the keyword here. Also, to have a AUP that gives the ISP right to disconnect or block offenders is importent, and also that the customer has right to service. Any aggreement is twofold, both rights and obligations, like in society in general. I'm glad that spam is recignised as the problem it is and hope a renewed activity to claim back the bandwitdh and storage space the spammer has taken from us. Yours -- Peter Håkanson There's never money to do it right, but always money to do it again ... and again ... and again ... and again. ( Det är billigare att göra rätt. Det är dyrt att laga fel. )

Hi, Am 13.02.2017 um 22:18 schrieb peter h:

There is not any req that all customers always should be forced to use ISP relays, the default behaviour might be to use ISP relays, and to have DHCP given address. But for an extra service one could obtain a fixed address, and as extra service, use port 25. The main point is to have those "unaware" users, whos computers might be stolen, prevented. They won't notice, and they don't get harmed.

The best practice should be to (automatically?) block port 25 as soon as there are complaints about SPAM being sent from the according account. Maybe some good reputated blacklist providers could work together with ISPs to provide them real-time notifications for their IP allocations based on a kind of "push service". Then (as a provider) you have: A) Customers that can use any port unfiltered and are not complaining about blocked ports in your support department. B) If you receive notifications about SPAM being sent you have a good reason to block specific ports for this user (and, of course, send a notification to the customer). C) The customer is made aware that something inside his network is infected with malware which should get cleaned. The provider could offer help, fees apply. If I block port 25 outgoing by default, the user can sit there for ages in his home network while the malware is trying to send SPAM - but the customer won't notice. "Yes, of course, the computer is very slow, but..." As soon as the user moves his infected laptop to another network which don't have this blocking policy for whatever reason, the malware fires out its offers for medication to improve specific parts of the male body. And, besides of SPAM, there are also other services that are getting targeted by malware - for example SIP. You can set up a SIP server, reachable to the whole world on port 5060/UDP and you get a feeling that specific parts of the internet are trying to place phone calls to countries you wouldn't even find on a map ;-) THAT is more than a bit inconvenient - it's really harmful and costs real money (much money). But: Would you block port 5060 by default? And which other ports, too? And what about bruteforce attacks against websites? And why aren't ISPs blocking incoming packets to port 1900/UDP or port 5454/UDP by default, which are misused for DDoS attacks? I think blocking ports by default isn't the cure. It's just raising support volumes. IMHO the better way is to let customers learn from it (when they get instant notifications as soon as malware starts attacking others). Max