|
|
| (One intermediate revision not shown) |
| Line 1: |
Line 1: |
| - | == What is Project Tar? ==
| + | #REDIRECT [[Project Tar]] |
| - | | + | |
| - | Project Tar helps you reduce spam and helps us at [http://www.junkemailfilter.com Junk Email Filter] build our [[Spam_DNS_Lists|blacklist]]. This is done by adding a fake MX record to your existing MX lists. The fake MX record will be your highest numbered MX and it will point to one of our servers. We will not actually receive any of your email under any circumstances. We will return a 451 temporary error immediately after the DATA command. This tells the sender to come back later and try again. Good email is never lost using this method. Here's what a connection to tar looks like:
| + | |
| - | | + | |
| - | helo example.com
| + | |
| - | 250 tar.junkemailfilter.com Hello mail.example.com [1.2.3.4]
| + | |
| - | mail from:<spammer@spamdomain.com>
| + | |
| - | 250 OK
| + | |
| - | rcpt to:you@yourdomain.com
| + | |
| - | 250 Accepted
| + | |
| - | data
| + | |
| - | 451 DEFER - Try a lower numbered MX record - http://www.junkemailfilter.com
| + | |
| - | quit
| + | |
| - | 221 tar.junkemailfilter.com closing connection
| + | |
| - | | + | |
| - | == How Project Tar Works ==
| + | |
| - | | + | |
| - | Spammers however often try to go in the "back door" thinking that your backup servers hae less spam filtering than your main email server. So they send email to the highest numbered MX record first. And spammers don't retry so they make an attempt, it fails, and they go on to the next victim. In the process if we detect a spam bot signature then the IP address of the spam bot is added to our DNS blacklist. If you are also using our blacklist then there is an added bonus in that our blacklist will tune itself to your spam so that if the spam bots later try your main server then they will be caught.
| + | |
| - | | + | |
| - | Generally real messages would never hit this server, but if all your servers are down there is still no harm done. We can tell the difference between real email and virus infected spam bots. Although some spam bots are missed, there are no false positives.
| + | |
| - | | + | |
| - | == How much spam will be eliminated using Tar? ==
| + | |
| - | | + | |
| - | That depends on how much of your spam come from virus infected spam bots. This has no effect on spam comping from Google, Yahoo, or Hotmail. But it might eliminate 40% of your virus infected spam bot spam just using the fake MX record and if you also use the blacklist you might get more than 80% spam reduction in spam bot spam.
| + | |
| - | | + | |
| - | == Setting up your MX records to use Project Tar ==
| + | |
| - | | + | |
| - | Lets assume you have two MX records now and that your domain is example.com. Your MX might look like this.
| + | |
| - | | + | |
| - | mail.example.com 10
| + | |
| - | backup.example.com 20
| + | |
| - | | + | |
| - | What you would do is add a third MX record as follows:
| + | |
| - | | + | |
| - | mail.example.com 10
| + | |
| - | backup.example.com 20
| + | |
| - | tar.junkemailfilter.com 30
| + | |
| - | | + | |
| - | And that's all you have to do.
| + | |
| - | | + | |
| - | == Using Tar with Dead Domains ==
| + | |
| - | | + | |
| - | Do you have dead domains that still get a lot of spam? We are interested in harvesting them as well. If your domain is dead, especially if it's been dead for some time then you can help us build our blacklist by pointing your dead domain to our tar server. Just set your MX record as follows:
| + | |
| - | | + | |
| - | tar.junkemailfilter.com 10
| + | |
| - | | + | |
| - | If we detect that tar.junkemailfilter.com is your lowest MX record we will reject the email with a 550 response. This lets innocent email such as old email lists be cleanly rejected. And we are careful not to list any false positives.
| + | |
| - | | + | |
| - | == Additional Technical Details ==
| + | |
| - | | + | |
| - | Virus infected spam bots are optimized for delivering as much spam as possible. So after sending email they don't wait around and politely close the connection the way normal email servers do. They just leave it open and let it time out. To be polite would be a waste of time and bandwidth. And this is especially true with a few well timed response delays that would slow them down if they played by the rules. What we look for is the lack of using the QUIT command. So if they are on a high numbered MX that generally they should not be sending to AND they don't issue QUIT, and they commit a few other sins that we track we can usually identify them on the first attempt without false positives. This method has proven to be very effective in quickly identifying virus infected spam bots and getting them listed in 2 minutes from the spam attempt.
| + | |
| - | | + | |
| - | == Punishing Spammers ==
| + | |
| - | | + | |
| - | We also put in significant delays at each stage of the SMTP transaction (a few seconds) that tends to trip up and slow down spam bots. This keeps their connections open longer and slows them down making them less effective. It increases accuracy and causes spammers pain.
| + | |
| - | | + | |
| - | == Why are we doing this for free? ==
| + | |
| - | | + | |
| - | Because it helps us at [http://www.junkemailfilter.com Junk Email Filter] build a larger list. It help us block spam in our front end spam filtering operation making for happier customers. We also sell rsync access to our lists and it makes our lists more valuable. And if you like the results from this free service you might want to buy our full service. And we just hate spam in general and we get a thrill out of stopping it. So this is win/win.
| + | |
| - | | + | |
| - | == About the Name ==
| + | |
| - | | + | |
| - | Project Tar was originally known as Project Tarbaby, but that term is known to be racially charged to some. The intention behind the name was per [https://en.wikipedia.org/wiki/Tar-Baby the character (doll) that the book] was named for - where Br'er Rabbit (spammers) would get ensnared upon contact, and indeed, [https://newrepublic.com/article/93088/tar-baby-racist-slur many people seem unaware that to some there are racist overtones to the name]. But, unlike politicians who can't ever seem to admit something they said was misleading, uninformed or otherwise offensive to other people, we decided that even if it was arguable whether or not the name is inherently racist, what's the point of using a name that *might* be offensive to some people? We don't want to add to a culture of questionable references and inferences, since there's enough of that without adding something that's totally unnecessary. In order not to break various incoming links to this project, the page name unfortunately will remain for now as it was, and to any who are offended, we do apologize for that.
| + | |
| - | | + | |
| - | == Feedback ==
| + | |
| - | | + | |
| - | We'd like to hear how well this is working for you and your comments and suggestions. Send your thoughts to [mailto:support@junkemailfilter.com support@junkemailfilter.com].
| + | |
