Are Spammers Bypassing "Nolisting?"

Nolisting is a unique way to help get rid of spam in which a domain is configured with an invalid primary MX record.

The non-responding primary MX record will cause all initial attempts to send email to fail. Normal email servers will re-attempt delivery to lower-ranked MX records - so the message will actually get delivered with a minor delay.

However, spam sending software usually doesn't bother to reattempt delivery. Such software will not be able to deliver spam to inboxes protected by Nolisting.

There idea of forcing redelivery isn't new. Greylisting provides the same effect via email server software. It simply sends any connecting server a "try back later" message upon each initial attempted delivery. The advantage of Nolisting is that it doesn't require any special software or advanced configuration.

To what extent it works, Nolisting is a near-free way to stop spam email. Nolisting however has a downside - and I think I've fumbled into it firsthand. All spammers have to do to bypass it is send all email messages directly to the second-highest ranked MX record.

SpamButcher.com has two separate MX Records. Since one of our servers is configured as a backup (with a lower-priorty MX) - the only case it should get email is if our primary server is offline.

However, a lot of my incoming spam seems to be getting targeted directly at our backup mail server. It's hard to be certain -but this may be an effort to bypass Nolisting. While we don't use Nolisting - there's no reason to think it wouldn't be effective against someone who was.

It should be noted that Greylisting doesn't suffer from this simple work-around.

Back