Spammers Play Tricks With DNS

According to this eweek article, Spammers are increasingly sending junk email from unregistered domains, and then registering the domains after the spam is sent.

Having the mail sent from an unlisted domain supposedly bypasses various anti-spam filters.

It also apparently lets them claim the domain was registered, therefore avoiding the (remote) possibility of being prosecuted under the CAN-SPAM act.

I'm having trouble making any sense of this. Many server-side spam programs will simply dump a message if its originating domain doesn't actually exist. This is a pretty common test. Sending a message from a bogus domain is probably more likely to get it filtered than sending from a real one.

Many of the posters to the feedback for this article concur with this.

The suggested scenario is kind of like a bouncer at a night club having two lists - one is a list of all the people the world (registered domains), the other a list of people who shouldn't be let in (known senders of unwanted mail).

Imagine someone comes to the door, and the name on their driver's list isn't on either list. What should the bouncer do?

If he's worth his $16 / hour, he'll realize that the person must have made up a fake name (unregistered domain), and is presumably up to no good.

The author of this article suggests that an e-mail spam blocker would typically reach the exact opposite conclusion - which usually isn't the case.

SpamButcher is an advanced spam stopping application and its trial version is available as a free antispam download.

Back