Introduction of theS25R anti-spam system
ASAMI Hideo
deo@gabacho-net.jp
http://www.gabacho-net.jp/en/anti-spam/
Aug 29, 20091

What is S25R?
The Selective SMTP Rejection Anti-spam System(port 25)

Gist of the action• Rejects receiving mail returning a retry request(response code “450”) when the client host is supposed
to be an end-user’s compter being based on its reversename.
• Receives mail by whitelisting the host when a mailserver is misidentified and so retry accesses are found.
2

Concept of mail route restriction
sender sitemailserverSMTP /SMTP-AUTH

PC

recipient site
SMTP

SMTP

has no reverse nameor has a reverse namewith many numerals,
besides doesn’t retry

mailserver(protectionpoint)

POP /IMAPPC

3

How to configure/etc/postfix/main.cf
smtpd_client_restrictions =permit_mynetworks,
check_client_access regexp:/etc/postfix/white_list,
check_client_access regexp:/etc/postfix/rejections/etc/postfix/white_list
permission conditions for mail servers misidentified/etc/postfix/rejections
rejection conditions for end-user’s computers not blocked by the following conditions/^unknown$/
450 reverse lookup failure, be patient/^[^.]*[0-9][^0-9.]+[0-9].*¥./
450 S25R check, be patient/^[^.]*[0-9]{5}/450 S25R check, be patient/^([^.]+¥.)?[0-9][^.]*¥.[^.]+¥..+¥.[a-z]/
450 S25R check, be patient/^[^.]*[0-9]¥.[^.]*[0-9]-[0-9]/
450 S25R check, be patient/^[^.]*[0-9]¥.[^.]*[0-9]¥.[^.]+¥..+¥./
450 S25R check, be patient/^(dhcp|dialup|ppp|[achrsvx]?dsl)[^.]*[0-9]/
450 S25R check, be patient4

Examples of blocked host names
unknown
evrtwa1-ar3-4-65-157-048.evrtwa1.dsl-verizon.net
pcp04083532pcs.levtwn01.pa.comcast.net
398pkj.cm.chello.no host.101.169.23.62.rev.coltfrance.com
wbar9.chi1-4-11-085-222.dsl-verizon.net
d5.GtokyoFL27.vectant.ne.jp
dhcp0339.vpm.resnet.group.upenn.edu PPPbf708.tokyo-ip.dti.ne.jp5Comparison of spam blocking rates
DNSBL
50--60%?
E-mail reputation about 70%
Bayesian filter
80--90%S25R
97--99%6

You must NOT ...
• specify “REJECT” (the response code “554”).
• leave retry accesses without watching the maillog.
* Retry period is 5 days by default setting of Postfix
or sendmail (= given period for acceptance).
* Some mail servers stop retry in about 2 days.
* It is hard to accept mail servers which stop retry
in about an hour. It is recommended to install thepublished white list or greylisting (such as Rgrey).

7

False positive rate
about 13% without a white list
Major cases that legitimate mail servers are blocked by S25R
• reverse lookup failure / paranoid test error• reverse host names including a serial number
assinged by an ISP which has many subscriber lines• reverse host names including a serial number
assinged by a company which has many servers

The false positive rate reduces as the white list becomesenriched.

8Virtuous circle of the white list
S25R is usedbecause of its
easiness to use.

White list
information iscontributed.

Less false positive
rate makes S25R
easier to use.

The published
white list becomesenriched.

The published white list: now includes about 700 items
9Log sorting script for finding
retry accesses easily• Retry accesses (with the same IP address, sender addess andrecipient address) are shown as lines in a sequence.
=>Whitelist the host if the sequense shows behavior of a legitimate
mail server.
Generally, it retries for 30 mintes or moreat an interval of 1 munute or more.
• An access which is not retried is shown as a single line separated
by a blank line.
=>You can ignore it.
• Estimated message count (nealy equal to the number of spammessages which might have been received if they were not blocked)
is displayed.
=>You can use it for statistics.
10Automatic acceptance of hosts
in false positives
Acceptance of hosts in false positives can be automatedby using greylisting or tarpitting together with S25R.
manualautomatic

merits•Additional software is notneeded (in case of Postfix).
•Stringent against retried
spam accesses.

•Few labor is needed forwatching.
•Acceptance succeeds even if
the retry period is short.

demerits•Much labor is needed forwatching.
•Acceptance may fail if theretry period is shorter than
the watching interval.

•Additional software is needed.
•Retried spam accesses may
cheat the protection system(greylisting reduces 1% in thespam block rate).
11

Development by other volunteersfor Postfix

Rgrey
StarpittaRgrey

for qmailS25R application patch for qmail
Qgrey
s25rtarpitgreylist

for sendmail

smtp_wrapper
application with milter

for XMailapplication with XMailCFG

for mail clients filter configuration for Becky! (by myself)
Becky! S25R spam filter
MailUtl3
12

Praises for S25R
• Surprising effectiveness! Legitimate mailcan be received correctly.
• We had been in trouble over disk
exhaustion by spam. We were survived.
• We can never abandon it.
• We recommend S25R for the customers ofour hosting service.
13Criticisms against S25R
criticisms

answers

Some legitimate mail servers don’t
have a reverse name.

You can receive mail by whitelisting while retry accesses
are coming.

Some legitimate mail servers have arevers name with many numarals.

You can receive mail by whitelisting while retry accesses
are coming.

It excludes mail servers with a dynamic
IP address.

I hope such mail servers send out mail through your ISP’s
mail server.

Don’t reject accesses selfishly on
Wait for whitelisting in the recipient site. It is mistaken
nothing but the result of reverse lookup. operation if they leave retry accesses.
It is not useful but for a personal site.

The published white list has become useful for large sites.

Receiving defers.

Using greylisting or tarpitting reduces deferment. You
shouldn’t use it if you dislike even a little deferment.

Retry request loads the sender sites
with the disk resource.

There is no problem even if mail stays in the sending
queue. Loads on the Internet relay lines reduces.

14

Why has S25R spread?
The number of sites applying it: estimated to be over 1000•••••High effectiveness.
Free of charge.
High skill is not needed for installation and operation.
You don’t need to ask anything of sender sites.
The published white list has become enriched bycontributors.
• Using greylisting and tarpitting was put into practice.
• It has become applicable for also qmail, sendmail andXMail.
• Besides the name is good?
Demand for ISPs: the service which enables users of connection
with one IP address to assign their own reverse name15

Appendix: The teachings to foresee
the future prospects
People who first critisized things which have spread
AGAWA Hiroyuki... Shinkansen
ITOKAWA Hideo... VTR for home use
pros and semipros of computers ... WindowsThings which satisfy the public needs
with continuous efforts shall win.

16