RFC 2635

DON'T SPEW A Set of Guidelines for Mass Unsolicited Mailings and Postings (spam*)

📅 published June 1999, from ietf

DON'T SPEW 🍓

A Set of Guidelines for Mass Unsolicited Mailings and Postings (spam*) 💌

Okay bestie, let's do the paperwork first 📋. This is RFC 2635, filed as FYI 35, so it's Informational (it's giving "here's some info," not "you must do this"). It was written by S. Hambridge from INTEL and A. Lunde from Northwestern University, and it's dated June 1999. The title block doesn't list anything it obsoletes or updates, so it's just vibing on its own 🦋

Status of this Memo

This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.

Copyright (C) The Internet Society (1999). All Rights Reserved.

Abstract

This document explains why mass unsolicited electronic mail messages are harmful in the Internetworking community. It gives a set of guidelines for dealing with unsolicited mail for users, for system administrators, news administrators, and mailing list managers. It also makes suggestions Internet Service Providers might follow. ✨

1. Introduction ✨

The Internet's origins in the Research and Education communities played an important role in the foundation and formation of Internet culture. 🎓 This culture defined rules for network etiquette (netiquette) and communication, based on the Internet being relatively off-limits to commercial enterprise. It was very much a "no shopping here" vibe 🙅‍♀️

This all changed when the U.S. Government was no longer the primary funding body for the U.S. Internet, when the Internet truly went global, and when all commercial enterprises were allowed to join what had been strictly research networks. 🌍 Internet culture had become deeply embedded in the protocols the network used. Although the social context has changed, the technical limits of the Internet protocols still require a person to enforce certain limits on resource usage for the 'Net to function effectively. Strong authentication was not built into the News and Mail protocols. 😬 The only thing that is saving the Internet from congestion collapse is the voluntary inclusion of TCP backoff in almost all of the TCP/IP driver code on the Internet. There is no end-to-end cost accounting and/or cost recovery. Bandwidth is shared among all traffic without resource reservation (although this is changing).

Unfortunately for all of us, the culture so carefully nurtured through the early years of the Internet was not fully transferred to all those new entities hooking into the bandwidth. 💔 Many of those entities believe they have found a paradise of thousands of potential customers, each of whom is desperate to learn about stunning new business opportunities. 💸 Alternatively, some of the new netizens believe all people should at least hear about the one true religion or political party or process. 🙃 And some of them know that almost no one wants to hear their message but just can't resist how inexpensive the net can be to use. 🥲 While there may be thousands of folks desperate for any potential message, mass mailings or Netnews postings are not at all appropriate on the 'Net. 🚫

This document explains why mass unsolicited email and Netnews posting (aka spam) is bad, what to do if you get it, what webmasters, postmasters, and news admins can do about it, and how an Internet Service Provider might respond to it. 🫶

2. What is Spam*? 🙈

The term "spam" as it is used to denote mass unsolicited mailings or netnews postings is derived from a Monty Python sketch set in a movie/tv studio cafeteria. 🎬 During that sketch, the word "spam" takes over each item offered on the menu until the entire dialogue consists of nothing but "spam spam spam spam spam spam and spam." 💀 This so closely resembles what happens when mass unsolicited mail and posts take over mailing lists and netnews groups that the term has been pushed into common usage in the Internet community. It's giving perfect metaphor 👑

When unsolicited mail is sent to a mailing list and/or news group, it frequently generates more hate mail to the list or group or apparent sender by people who do not realize the true source of the message. 😤 If the mailing contains suggestions for removing your name from a mailing list, 10s to 100s of people will respond to the list with "remove" messages meant for the originator. 🙄 So, the original message (spam) creates more unwanted mail (spam spam spam spam), which generates more unwanted mail (spam spam spam spam spam spam and spam). It's a whole chain reaction, bestie 🌪️ Similar occurrences are perpetrated in newsgroups, but this is held somewhat in check by "cancelbots" (programs which cancel postings) triggered by mass posting. 🤖 Recently, cancelbots have grown less in favor with those administering News servers, since the cancelbots are now generating the same amount of traffic as spam. 🫠 Even News admins are beginning to use filters, demonstrating that spam spam spam spam spam spam and spam is a monumental problem. 🚨 Literally the whole thing is a mess, and it's not slowing down ngl 💅

3. Why Mass Mailing is Bad ✨

okay bestie, let's talk about paper mail 📬 we ALL get junk mail in our real mailboxes: catalogs, circulars, ads, the whole vibe. and honestly? most of us don't really mind. we look at whatever catches our eye and recycle the rest ♻️ so like... why should unsolicited email be any different?? 🤔

the answer is the cost model 💸 with paper, the sender pays. they have to pay to create the ad AND pay to mail it to you. an average paper commercial mailing in the U.S. ends up costing about $1.00 per addressee 😬 but with electronic messages, the recipient ends up covering most of the bill 🫠 the sender still has to write the message and pay for their internet connection, ngl. but the recipient ALSO has to pay for internet connectivity, and possibly connect time charges and disk space too 💀 so with email, the receiver is basically expected to help share the cost of the mailing 💅 bulk internet mail from the U.S. ends up costing the sender only about 1/100th of a cent per address, or FOUR ORDERS of magnitude LESS than bulk paper mailings! 🤯

of course, this cost model is super popular with people looking for cheap ways to get their message out 📣 but it's very unpopular with the people who have to pay for their messages just to find their mailbox full of junk 😤 they don't appreciate being forced to spend time learning how to filter out unwanted messages either. think about it: if you had to pay to receive paper mail, would you pay for junk mail? 🙃

another thing: more spam means the whole electronic mail thing gets less viable as a way to communicate 📉 imagine walking to your mailbox and finding four crates of mail. would you dig through all of them for the one or two pieces that weren't ads? 😭 spam has a tremendous potential to create exactly that scenario online.

spammers also get up to some seriously unethical stuff 🙅‍♀️ like using mail servers that allow mail to be relayed, so they can send huge amounts of electronic solicitations. or they forge their headers to make it look like the mail came from a different domain 🎭 these people don't care that they're intruding into a personal or business mailbox, and they don't care that they're using other people's resources without paying them back. rude behavior, no notes. 💅

the huge cost difference has other bad effects too. even a very cheap paper mailing is going to cost tens of (U.S.) cents, so there's a real incentive to only send to people who are really likely to be interested 🎯

that's why paper bulk mailers often pay a premium for high quality mailing lists 📋 they carefully prune out bad addresses and pay for services to update old ones. bulk email is so cheap that hardly anyone sending it bothers to do any of this 🙈 so the chance that the receiver is actually interested in the mail is very, very, very low. 😩

here's the scary part: as of this document, it's a daily event on the Internet for a mail service to melt down because of spam overload 🫠 every few months, this happens to a large/major/regional/national/international service provider, and hundreds of thousands of users get denied service or see it badly degraded. those service degradations usually push providers to spend hundreds of thousands of dollars upgrading their mail equipment, just because of the spam volume 💸 and then the providers pass those costs on to customers. so we all end up paying for it 🥲

okay but wait, doesn't the U.S. Constitution guarantee the right to say whatever you like? 🇺🇸 not so fast, bestie 🙅‍♀️ first, the U.S. Constitution is law only in the U.S., and the Internet is global 🌍 there are places your mail will reach where free speech isn't a given. second, the U.S. Constitution does NOT guarantee the right to say whatever you like. in general, it talks about political freedom of speech, not commercial freedom of speech 🧾 finally, and most importantly, the U.S. Constitution does NOT guarantee the right to seize other people's private property to broadcast your speech 🚫 the Internet is a huge number of privately owned networks working together voluntarily 🤝 there are laws that govern other areas of electronic communication, like the "junk fax" laws. those haven't been applied to email yet, but they're still an example of the "curbing" of "free speech" 📠 free speech doesn't, in general, require other people to spend their money and resources to deliver or accept your message. period. 💅

most responsible Internet citizens now see unsolicited mail and posts as "theft of service" 🫣 the recipient has to pay for the service, and most of these messages are ads for unsolicited "stuff" like products, services, or information. so people who get them think making the recipient pay is basically theft 😤

sending big piles of unsolicited mail and news isn't really a legal issue as much as an ethical one 🧠 so if you're tempted to send unsolicited "information," ask yourself these questions:

  • "Whose resources is this using?"
  • "Did they consent in advance?"
  • "What would happen if everybody (or a very large number of people) did this?"
  • "How would you feel if 90% of the mail you received was advertisements for stuff you didn't want?"
  • "How would you feel if 95% of the mail you received was advertisements for stuff you didn't want?"
  • "How would you feel if 99% of the mail you received was advertisements for stuff you didn't want?"

🪞 honest reflection time, fr fr.

numbers on the volume and growth rate of spam aren't easy to find 📊 but seat-of-the-pants estimates from people on spam discussion mailing lists [1] suggest unsolicited mail and posts are growing exponentially, just like the Internet as a whole [2] 📈 and that is NOT encouraging, bestie 😬 this kind of growth strains servers, connections, routers, and the bandwidth of the entire Internet. on a per person basis, unsolicited mail is going up too, so individuals also end up paying more and more for mail nobody asked for 🥴 if you want hard numbers, point your web browser to http://www.techweb.com/se/directlink.cgi?INW19980504S0003, where Internet Week reports what spam costs 💰

finally, sending huge volumes of unsolicited email or posting massive numbers of Netnews postings is just plain rude 🙅‍♀️ picture this: you find a big party going on in a house on your block. uninvited, you show up, then shove your way into each group conversation 🗣️ you SHOUT YOUR OPINION through a megaphone about whatever's on your mind, drown out everyone else, and then scream "discrimination" when people tell you you're being rude 📢💀

now let's do the party again, but this time you stand on the outskirts for a while and just listen 👂 then you slowly start adding comments that are relevant to the conversation. then you start telling people your opinion on the issues they're discussing. they'd probably be less inclined to judge you harshly for intruding 🤏 but you're still intruding, bestie. and it would still be considered rude to offer to sell products or services to the guests, even if they were relevant to the discussion 🙅‍♀️ you're in the wrong venue, and you need to find the right one 📍

lots of spammers act like their behavior is forgivable if they start their messages with an apology 🙏 or personalize them with your real name 🪪 or use a bunch of other ingratiating tricks. but just like the techniques used by Uriah Heep in Dickens' David Copperfield, these usually backfire 📚 poor excuses like "It's not illegal," "This will be the only message you receive," "This is an ad," and "It's easy to REMOVE yourself from our list" are still excuses 🙄 and they're likely to make the recipient MORE aggravated, not less. 😤🔥

and there are two very severe problems with thinking a "remove" feature will stop future mail 🚨

  1. careful tests were done by sending remove requests for "virgin" email accounts (accounts that have never been used anywhere else). in over 80% of the cases, this resulted in a deluge of unsolicited email, although usually from other sources than the one the remove was sent to 😱 so if you don't like unsolicited mail, think carefully before using a remove feature, because the evidence says it will bring in MORE mail, not less.
  2. even if it did work, it wouldn't stop the lots of new unsolicited email that shows up every day from new businesses that hadn't mailed before 🫠 the remove button can't stop what it hasn't seen yet, bestie. 💅

4a. ACK! I've Been Spammed - Now What? 💅

okay bestie, getting mail you never asked for is so unpleasant 😤 and if you're paying for connect time to download it, it's even worse 💸 and getting stuff about topics you find offensive? literally the worst 🙈 so now that you're good and mad, what's an appropriate response? let's talk ✨

First, you always have the option to delete it and get on with your life 🦋 this is the easiest and safest move. it doesn't guarantee you won't get more of the same later 😭 but it does handle the current problem. also, if you don't read your mail on a regular basis, your complaint might be way too late to do any good 💀

Second, think about strategies that use screening tech 🧚 you could look into tools that let you filter unwanted mail before you even see it. some software lets you scan subject lines and delete unwanted messages before you download them. other programs can be set up to download parts of messages, check them to see if they're advertising (for example), and delete them before the whole message gets downloaded 🌸

Also, your organization or your local Internet Service Provider might be able to block unwanted mail at their mail relay machines 🛡️ that way you don't have to deal with it at all 🙌 it's worth asking about if you're getting hit with frequent spam.

Your personal mailer might let you write rules about what you do and don't want to read 📬 if it does, write a rule that sends mail from the originator of the unwanted mail to the trash 🗑️ this works if one sender or site keeps bothering you. you might also write rules based on other headers, if you're sure the chance of them triggering on non-spam is low enough 🎀 that way you may still have to pay to download it, but you won't have to read it! iconic 👑

Third, you could send the mail back to the originator and tell them you object to being on the mailing list 💌 however, we recommend against this 🙅 (lowkey I'd skip it too). first, a lot of spammers disguise who they are and where their mail comes from by forging the mail headers 🎭 unless you're super experienced at reading headers, finding the true origin will probably be hard. your local support staff can help with this, but they may have way higher priorities, like setting up site-wide filters to keep spam out of the site 🏰 second, replying just confirms your address is valid and makes it more valuable for other (ab)uses (as was mentioned above in Section 3) 💸 third, even if the first two things don't happen, your mail will very probably end up in the computer equivalent of a black hole, the bit-bucket 🕳️

As of writing, there is pending legislation in several jurisdictions about sending unsolicited mail and also about forging headers ⚖️ if forging headers ever becomes illegal, responding to the sender is less risky and may be useful then 🫶

Certainly we advocate telling the originator (as best you can tell who they are) that you will NOT be buying any products from them, because you object to the way they run their business (aka spam) 🙅‍♀️ most responses through media other than email (mostly from people who take the time to phone, including "800" (free to calling party in the U.S.) phone numbers) have proved somewhat effective 📞 you can also call the business the ad is for, ask to speak to someone in authority, and then tell them you will never buy their products or use their services because their advertising mechanism is spam 💅

Next, you can carbon copy or forward the questionable mail messages or news postings to your postmaster 📨 you can do this by sending mail to To: Postmaster@your-site.example. your postmaster should be an expert at reading mail headers and will be able to tell if the originating address is forged 🔍 they may be able to pinpoint the real culprit and help shut down the site 🔒 if your postmaster wants to know about unsolicited mail, be sure they get a copy, including headers. you'll need to find out the local policy and follow it 📋

🚨 IMPORTANT 🚨 Wherever you send a complaint, be sure to include the full headers (most mail and news programs don't display the full headers by default 🙈). for mail it is especially important to show the Received: headers. for Usenet news, it is the Path: header. these normally show the route by which the mail or news was delivered 🗺️ without them, it's impossible to even begin to tell where the message originated. see the appendix for an example of a mail header 📎

There is lively and ongoing debate about the validity of changing your email address in a web browser so that Netnews posts and email look like they're coming from some spot other than where they actually come from 🤔 the reasoning is that web email address harvesters won't get a real address when they run into these. there's reason on both sides: if you change your address, you won't be as visible to the harvesters, but real people who need to contact you will be cut off as well 😬 also, if you're using the Internet through an organization such as a company, the company may have policies about "forging" addresses, even your own! most people agree that changing your email address in your browser, or even in your mail headers, is fairly dangerous and will nearly guarantee your mail goes into a black hole, unless you are very sure you know what you're doing 🕳️

Finally, DO NOT respond by sending back large volumes of unsolicited mail 🛑 two wrongs do not make a right, do not become your enemy, and take it easy on the network 🫶 while the legal status of spam is uncertain, the legal status (at least in the U.S.) of a "mail bomb" (large numbers and/or sizes of messages to the site with the intent of disabling or injuring the site) is pretty clear: it is criminal 🚔

There is a web site called www.abuse.net which lets you register, then send your message to the name of the offending-domain@abuse.net, which will re-mail your message to the best reporting address for the offending domain 💖 the site has good tips for reporting abuse in netnews or email messages. it also has some automated tools you can download to help filter your messages 🧰 also check CIAC bulletin I-005 at:

http://ciac.llnl.gov/ciac/bulletins/i-005c.shtml

or at:

http://spam.abuse.net/spam/tools/mailblock.html.

check the Appendix for a detailed explanation of tools and methodology to use when trying to chase down a spammer 🕵️‍♀️

4b. There's a Spam in My Group! 🫶

netnews gets spammed too 😭 a few factors help keep spam from spreading in news, although they don't entirely solve the problem. newsgroups and mailing lists may be moderated, which means a moderator approves all mail and posts 👑 if that's the case, the moderator usually acts as a filter and removes unwanted and off-topic posts or mail ✨

in Netnews there are programs that detect posts sent to multiple groups, or detect multiple posts from the same source to one group. these programs cancel the posts 🧹 they work and keep unsolicited posts down, but they aren't 100% effective, and spam in newsgroups seems to be growing even faster than spam in mail or on mailing lists 📈 it makes sense, honestly: it's way easier to post to a newsgroup with thousands of readers than to find individual email addresses for all those folks 🤷‍♀️ that's how we got the "cancelbots" (sometimes called "cancelmoose") for Netnews groups 🫎 cancelbots are triggered when one message is sent to a large number of newsgroups, or when many small messages are sent (from one sender) to the same newsgroup. in general they're tuned to the "Breidbart Index" [3], which is a somewhat fuzzy measure of how the number of posts and the number of groups interact. the fuzziness is on purpose, so people won't post a bunch of messages just under the index and still "get away with it" 😤 and as noted above, the cancel messages have reached such a volume that a lot of News administrators are starting to write filters instead of sending cancels 📝 still, spam gets through. so what can a concerned netizen do? 🤔

if there's a group moderator, make sure they know that off-topic posts are slipping into the group 📣 if there's no moderator, you can take the same steps for dealing with news that are recommended for mail, with all the same caveats ⚠️

a reasonable printed reference you might get is the O'Reilly and Associates book Stopping Spam, by Alan Schwartz and Simson Garfinkel [4] 📚 it also has interesting histories of spammers like Cantor and Siegel, and Jeff Slaton 🎭 it gives pretty clear instructions for filtering mail and news 💅

5. Help for Beleaguered Admins ✨

okay bestie, if you're a system administrator, news administrator, local Postmaster, or mailing-list administrator, your users are gonna come running to you for help with unwanted mail and posts 🫶 so here's the game plan. First, find out what your institution's policy is on unwanted/unsolicited mail. It's possible it won't do anything for you 💀 but it's also possible to use it to justify blocking a domain that's sending really offensive mail to your users. If you don't have a clear policy, honestly it would be super useful to create one 📝 If you're a mailing-list admin, make sure your mailing-list charter forbids off-topic posts 🌸 And if your internal-only newsgroups are getting spammed from outside your institution, ngl you've got bigger security problems than just spam 😭

Next, make sure your mail and news transports are configured to reject messages injected by parties outside your domain 🚫 Misconfigured Netnews servers have recently become a target for spammers who hijack them, which is so not it. SMTP source routing, written as <@relay.host:user@dest.host>, is becoming deprecated because spammers abuse it so hard 💅 You should configure your mail transport to reject relayed messages (when neither the sender nor the recipient are within your domain). Check out http://www.sendmail.org/ under the "Anti-Spam" heading 🦋

If you run a firewall at your site, it can be set up in ways that discourage spam 🧱 For example, if your firewall is a gateway host that also has an NNTP server, make sure it doesn't allow access from external sites except your news feeds. If your firewall acts as a proxy for an external news server, make sure it doesn't accept NNTP connections from anywhere except your internal network. Both of these holes have recently been exploited by spammers, so yikes 😬 Also, email generated within your domain should have proper identity information in the headers, and users should not be able to forge headers 🎀 Your headers need all the correct info stipulated by RFC 822 [5] and RFC 1123 [6], no shortcuts!

If you're running a mailing list, letting only subscribers post means a spammer would actually have to join your list before sending spam, which is pretty unlikely 🙈 Make sure your charter forbids any off-topic posts too. Here's another spam-related problem with mailing lists: spammers like to get revenge on people who work against them by mass-subscribing their enemies to mailing lists 💀 So your mailing-list software should require confirmation of the subscription, and only after that should the address actually get subscribed 🫶

If you're running a mail transfer agent that allows it, you can block persistant offending sites from ever getting mail into your site 🚷 But take careful consideration before doing that. For example, be careful not to block out sites for which you run MX records! In the long run, the most useful thing might be helping your users learn enough about their mailers that they can write rules to filter their own mail 🧚 You can also provide rules and kill files for them to use, if they choose to 💜

There's info about how to configure sendmail at "www.sendmail.org." Help is also available at "spam.abuse.net." 🌈

Another great strategy is using Internet tools like whois and traceroute to find which ISP is serving your problem site 🔍 Then notify the postmaster or abuse address (abuse@offending-domain.example) that they have an offender. Be sure to pass along all the header information in your messages so they can track the offender down 🕵️‍♀️ If they have a policy against using their service to post unsolicited mail, they'll need more than just your say-so that there's a problem. Also, the "originating" site may be a victim too! It's not unknown for spammers to bounce their mail through dial-up accounts, or off unprotected mail servers at other sites 😳 So use caution and courtesy when you approach anyone who looks like the offender 🌸

News spammers use similar techniques to send spam to groups 📰 They've been known to forge headers and bounce posts off "open" news machines and remailers to cover their tracks. During the height of the infamous David Rhodes "Make Money Fast" posts, it was not unheard of for students to walk away from logged-in terminals, and for sneaky folks to then use those accounts to forge posts. Cue the later embarrassment for both the student and the institution 💀

One way to lessen the problems is to avoid using mail-to URLs on your web pages 🙅‍♀️ They let email addresses get easily harvested by those grabbing addresses off the web. If you really need an email address to show up on a web page, consider using a cgi script to generate the mailto address instead 🧚

Participate in mailing lists and news groups that discuss unsolicited mail/posts and the problems that come with them 🗣️ News.admin.net-abuse.misc is probably the most well-known of these. Main character energy 👑

6. What's an ISP to Do 🌐

As an Internet Service Provider, the first and most important thing is deciding what your stance on unsolicited mail and posts will be 💅 If you decide not to tolerate unsolicited mail, write a clear Acceptable Use Policy that states your position and spells out the consequences for abuse 📜 If you say you won't tolerate using your resources for unsolicited mail/posts, and the consequence is loss of service, you should be able to cancel offending accounts pretty quickly (after you've verified that the account really IS being misused 👀). If you have downstreaming arrangements with other providers, make sure they know about any policy you set 🤝 And likewise, be aware of your upstream providers' policies too.

Consider limiting access for dialup accounts so they can't be used by people who spew 📞 Make sure your mail servers aren't open for mail to be bounced off them (except for legitimate users) 🚫 And make sure your mail transfer agents are the most up-to-date version of the software, the kind that passes security audits 🔐

Educate your users about how to react to spew and spewers 🫶 Make sure instructions for writing rules for mailers are clear and easy to find. Support their efforts to deal with unwanted mail at the local level, which takes some of the burden off your system administrators 🎀

Make sure you have an address for abuse complaints 📬 If complainers can routinely send mail to "abuse@BigISP.example" and you have someone assigned to read it, workflow is gonna be so much smoother. Don't make people complaining about spam use some unique local address for complaints. Read and use 'postmaster' and 'abuse'. We recommend following RFC 2142, Mailbox Names for Common Services, Roles and Functions. [7] 🧚

Finally, write your contracts and terms and conditions in language that lets you suspend service for offenders 🔒 Also make sure they let you charge offenders for your costs in handling the complaints their abuse creates, and/or for terminating their account and cleaning up the mess they make 💸 Some large ISPs have found they can fund a lot of their abuse prevention staff this way, iconic 👑 Make sure all your customers sign the agreement before their accounts are activated. There's a list of "good" Acceptable Use Policies and Terms of Service at http://spam.abuse.net/goodsites/index.html. 🌈

Legally, you may be able to stop spammers and spam relayers, but that really depends on the jurisdictions involved ⚖️ Passing spam through third-party computers, especially when the headers are forged, could potentially be a criminal action depending on the laws of the particular jurisdiction(s) involved. If your site is being used as a spam relay, be sure to contact local and national criminal law enforcement agencies 🚨 Site operators may also want to consider civil actions against the spammer for expropriation of property, especially the computer time and network bandwidth 💜 And when a mailing list is involved, there's a potential intellectual property rights violation too.

There are a few lawsuits in the courts right now claiming spammers interfered with and endangered network connectivity 🏛️ At least one company is trying to charge spammers for using its networks (www.kclink.com/spam/). Bold move 💅

7. Security Considerations 🔐

⚠️ Okay bestie, this section is dead serious, so read it carefully.

Certain actions to stop spamming may cause problems for legitimate users of the net 😭 There's a risk that filters meant to stop spam will unintentionally stop legitimate mail too. Overloading postmasters with complaints about spamming may cause trouble for the wrong person, someone who isn't responsible for the spamming and can't do anything to avoid it, or it may cause trouble out of proportion to the abuse you're complaining about 🙅‍♀️ So be sure to use discretion and good judgment in all these cases. Check your local escalation procedure. The Site Security Handbook [2] can help you define an escalation procedure if your site doesn't have one 📋

Lower levels of network security interact with your ability to trace spam via logs or message headers 🕵️‍♀️ Measures that stop various sorts of DNS and IP spoofing can make this information more reliable. Spammers can and will exploit obvious security weaknesses, especially in NNTP servers 💀 This can lead to denial of service, either from the sheer volume of posts, or as a result of action taken by upstream providers 🚨

8. Acknowledgments 🫶

Thanks to the IETF-RUN working group, and to all the spew-fighters out there 💖 Special thanks to J.D. Falk, whose very helpful Anti-spam FAQ proved valuable 📚 Thanks also to the vigilance of Scott Hazen Mueller and Paul Vixie, who run spam.abuse.net, the Anti-spam web site 🦋 Thanks to Jacob Palme, Chip Rosenthal, and Karl Auerbach for specific text: Jacob for the Security Considerations section, Chip for the configuration suggestions in section 5, and Karl for the legal considerations ⚖️ Andrew Gierth was very helpful with Netnews spam considerations 📰 And a big thank you to Gary Malkin for proofing and formatting 🎀

9. References 📚

  • [1] See for example spam-l@peach.ease.lsoft.com
  • [2] Fraser, B., "Site Security Handbook", FYI 8, RFC 2196, September 1997.
  • [3] "Current Spam thresholds and guidelines," Lewis, Chris and Tim Skirvin, http://www.killfile.org/~tskirvin/faqs/spam.html.
  • [4] Schwartz, Alan and Simson Garfinkel, "Stopping Spam," O'Reilly and Associates, 1998.
  • [5] Crocker, D., "Standard for the format of ARPA Internet text messages", STD 11, RFC 822, August 1982.
  • [6] Braden, R., "Requirements for Internet hosts - application and support", STD 3, RFC 1123, October 1989.
  • [7] Crocker, D., "Mailbox Names for Common Services, Roles and Functions", RFC 2142, May 1997.
  • Spam is a name of a meat product made by Hormel. "spam" (no capitalization) is routinely used to describe unsolicited bulk email and netnews posts. 🥫💅

10. Appendix - How to Track Down Spammers 🔍

okay so bestie, spam is literally so sneaky 😭 a lot of the time, emailing the postmaster of the site that looks like the sender is a total waste of time. why? because the headers might be forged to hide where the message really came from, or the spammers run their own system/domain, or both 💀

so you might have to look really carefully at the headers to figure out which parts you can actually trust 🧐 and you might need to complain to the second- or third-level Internet providers that give service to the problem domain. it's giving detective era 🕵️‍♀️✨

getting full headers from a bunch of different recipients of the same spam can really help find the source 🙌 and in the most extreme forgery cases, only checking logs on multiple systems can trace it. no cap.

if you only have ONE message, you're basically making an educated guess 🥺 the guidelines below are just rough vibes, not rules, fr fr 🫶

for mail messages, the "Received:" headers added by systems that the destination organization controls are the most reliable 💖 you can't really trust what the source domain calls itself, but you can usually trust the source IP address, because the destination domain's server is the one that determines it. iconic 👑

in naive mail forgeries, the "Message-ID:" header might show the first SMTP server that handled the message, and/or the "Received:" headers might all be accurate, but neither one can be relied on 🙈 so be extra suspicious when the Received: headers have other headers mixed in between them. normally all the Received: headers sit together in one block, and if they're split up, one of the blocks is probably forged. periodt 💅

for news messages, some part of the Path: header might be forged, and only reports from multiple sites can make that clear 🧚 in naive news forgeries, the "NNTP-Posting-Host:" header shows the actual source, but that can be forged too, so don't just vibe with it 😭

if a spam advertises an Internet server like a WWW site, that server has to be connected to the network to be usable 🌐 which means that address can be traced! it's appropriate to complain to the ISP hosting an advertised web site, even if the spam seems to come from somewhere else. but be aware the spam could be an attack on the advertised site 😬 the spammer knows that site will get buried in complaints and that its reputation will take a hit. and any spam with an electronic address in it is suspect, because most spammers know they're unwelcome and won't make themselves reachable 🙄

here's an example mail header, bestie 🎀

----
From friendlymail@209.214.12.258.com Thu Feb 26 20:32:47 1998
Received: from clio.sc.intel.com by Ludwig.sc.intel.com (4.1/SMI-4.1)
        id AA05377; Thu, 26 Feb 98 20:32:46 PST
Received: from 209.214.12.258.com (209.214.12.258.com [208.26.102.16])
        by clio.sc.intel.com (8.8.6/8.8.5) with ESMTP id UAA29637
        for <sallyh@intel.com>; Thu, 26 Feb 1998 20:33:30 -0800 (PST)
Received: ok
X-Sender: promo1@gotosportsbook.com
X-Advertisement: <a href="http://www.opt-out.com">
Click here to be removed.
Date: Thu, 26 Feb 1998 23:23:03 -0500
From: Sent By <promo1@gotosportsbook.com>
Reply-To: Sent By <promo1@gotosportsbook.com>
To: friend@bulkmailer
Subject: Ad: FREE $50 in Sportsbook & Casino
X-Mailer: AK-Mail 3.0b [eng] (unregistered)
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: friendlymail@aqua.258.com
Message-Id: <bulk.6508.19980226232535@aqua.258.com>
Status: R
----

running a traceroute on an IP address or DNS address shows you which domains provide IP connectivity from you to that address 🛤️ and whois and nslookup can help you figure out who is administratively responsible for a domain 🔎

in simple cases, a user at a responsible site might be exploiting an account or a weakness in dial-up security 😤 in those cases, a complaint to that one site might be enough. but it can make sense to complain to more than one domain, especially when it looks like the spammers run their own system 💜

if you look at the traceroute to an address, you'll usually see a bunch of domains between you and that address, with one or more wide-area/national Internet Service Providers in the middle and "smaller" networks/domains on either end ✨ it can be right to complain to the domains closer to the source, all the way up to and including the nearest wide-area ISP. however, this is a judgement call 🤷‍♀️

and if an intermediate site seems to be a known, responsible domain, it makes sense to stop your complaints there 🫶

Authors' Information 🎀

Sally Hambridge
Intel Corp, SC11-321
2200 Mission College blvd
Santa Clara, CA 95052

EMail: sallyh@ludwig.sc.intel.com


Albert Lunde
Northwestern University
Suite 1400
1603 Orrington Avenue
Evanston, IL 60201

EMail: Albert-Lunde@nwu.edu

Copyright (C) The Internet Society (1999). All Rights Reserved.

Okay, the legal stuff, but make it cute 🎀 this is the important bit, so read it carefully, bestie 💖

This document and translations of it may be copied and furnished to others, and derivative works that comment on or otherwise explain it or assist in its implementation may be prepared, copied, published and distributed, in whole or in part, without restriction of any kind. The one condition is that the above copyright notice and this paragraph are included on all such copies and derivative works 🦋

However, this document itself may not be modified in any way, such as by removing the copyright notice or references to the Internet Society or other Internet organizations 🚫 The only exceptions are when it's needed for developing Internet standards, in which case the copyright procedures defined in the Internet Standards process must be followed, or when it's required to translate it into languages other than English 🌍

The limited permissions above are perpetual and will not be revoked by the Internet Society or its successors or assigns ♾️💜

This document and the information in it is provided on an "AS IS" basis, and THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. 💀

Acknowledgement 🌸

Funding for the RFC Editor function is currently provided by the Internet Society 🫶💖

📦 where this page comes from