"Nolisting" - Greylisting's Cheap Cousin

I just read about a new approach to help reduce spam. It's certainly novel - but I'm not sure if I like it.

Nolisting is when a domain is intentionally (incorrectly) configured with a non-functioning primary MX record.

Each domain is supposed to have at least 2 separate incoming mail servers ("MX Records"). If the first server is not available, the server sending the email is supposed to retry sending the email to the next server on the list.

The theory is that most spamming software won't bother to retry sending a message after the request to the primary server times-out. Functionally this is a very similar effect to greylisting. The advantage is that no server-side spam control is needed at all. All someone has to do is modify their DNS.

Domains can still have backup mail servers - they would just be configured as yet additional MX records with "lower" (higher numbered) priority.

As with greylisting - the technique depends on the sending server being "RFC compliant." If the sending server doesn't play like it's supposed to - email may get lost.

Ironically, I'm not sure if having an intentionally bogus primary MX record exactly qualifies as being "RFC compliant" itself.

Still, most aspects of the SMTP standard are over 20 years old at this point. There doesn't seem to be a lot of excuse for a server being non-compliant.

The biggest candidates for non-spam, but non-compliant sources would be web-server based emailing components or other legitimate automated mailing systems.

Does this approach of fighting spam really work? This article suggests that it does - and with no anecdotal reports of false-positives.

But again, something just doesn't hit me right about exploiting technical loopholes in the RFC to gain effects that weren't intended in the first place. Forcing all email to be resent to the secondary MX server may work, but it's not how the system was designed to function. Of course, no one ever anticipated everyone getting 100 spam messages each day either.

So, for now - I'm going to "just say no" to Nolisting.

Back