Domain Registrars and Spam

Recently the domain registrar "Joker" came under a massive denial of service attack. Thousands of domains were impacted. Any domain which had its DNS hosted by Joker was offline for up to few days.

The outage only hit sites which actually had their DNS hosted with Joker. Those who only used Joker's services as a registrar didn't suffer any outage.

At this point, the perpetrator and motive for the attack aren't clear. In at least one online forum, a poster suggested that Joker was suffering payback for providing services to spammers.

I'm a customer of Joker, and never made a connection between them and spam. Some brief research indicated a lot of spammers have used Joker as a registrar. Of course, a lot of spammers have also used Verisign as a registrar. The difference perhaps being that Joker seems disproportionately popular considering its relatively small size.

The reasons for this are pretty clear. Joker was one of the first inexpensive registrars. Several years ago, there were only a few players in domain registration, and almost all of them wanted about $30 a year. At the same time Joker only charged $10. This made them popular with anyone looking to register a large number of domains, including spammers.

So should cheap registrars like Joker be considered candidates for anti-spam blacklists? Including them would certainly block a lot of genuine email. However, this could also be said for most other tactics used to block spam.

Fuzzy Logic and Bayesian spam filters allow for the notion of grey-listing. Grey lists work like network blacklists except that they are factored in with other filtering criteria to help detect unwanted emails. An email being sent from a grey listed network won't be filtered just for that reason, but it may be if other conditions are met. Perhaps problematic domains registrars could be included in filtering systems the same way.

Back