Forged outgoing emails resulting in huge numbers of bounced undeliverables..

[CasualObserver]

In the spring of this year I started seeing a new trend of waves of forged emails going out. They would target one specific email address at a domain and would last from 24 to 36 hours in general. The targeted person generally received 200 to 350 bounced undeliverables during this timeframe. They would then trickle off and the problem would go away until the next time that user was targeted which might be days, weeks or months.

Starting in September, I have seen these waves taken to a new level. Now over the period of several hours, I am seeing 5000 to 7500 bounced undeliverables being returned to a single user email address.

I am using Postini and have configured the optional NDR settings that they advised. As a result, these emails are being filtered into the users quarantine in Postini. This is still unmanagable since within several hours, their quarantine is flooded with 5000+ emails. In addition the person will receive 100 to 500 emails that still went through Postini due to being in another language or not matching the Postini NDR filter rules or null sender.

The last time I was personally hit by this, my Postini daily quarantine summary had 5074 items in it which was September 30th. I have had clients email me their summaries which showed over 7500 emails quarantined in one day.

At this point, I am looking at implementing Sender Policy Framework (SPF) as decribed at OpenSPF.

Does anyone have an idea how effective this might be? Any possible other solutions that might help prevent this flood of NDR's from occurring?

I have multiple domains hosted at Dathorn, and also multiple domains that use their own internal Exchange servers. One client wants to deploy Sunbelt Software' s Ninja product thinking it will solve all their problems. I personally doubt it wil be more effective then Postini already is. Has anyone used that with any feedback?

Just trying to figure out a way to stop this mess which is rapidly getting worse. Before, I thought the waves in Apirl were bad, this is another whole level of nasty.

[AndrewT]

In short, there is nothing that can prevent someone from forging your address in spam. Unfortunately this is just due to the way that e-mail currently functions. Until some form of sender authentication is used by every mail server, this will continue to be the case.

If you setup a working SPF record then mail servers that actually lookup and act on SPF records will reject the e-mail during the initial SMTP transaction with the original sender. In such a case, no bounce to you is generated. This can certainly help with the quantity of bounces but will not eliminate them.

[AndrewT]

Out of curiosity, have you enabled both the suggested content filter and the NDR filter (batch command)? While the NDR filter is certainly helpful certain mail servers will get through based on the format of their bounces which is where the content filter can probably catch most of them.

[CasualObserver]

Out of curiosity, have you enabled both the suggested content filter and the NDR filter (batch command)? While the NDR filter is certainly helpful certain mail servers will get through based on the format of their bounces which is where the content filter can probably catch most of them.

Yes, both the content filter and the NDR batch command were used on a new sub organization for the domains and the affected users moved to the sub organization. Followed the implementation directly from the white paper Postini had issued. Thinking about it, the null sender one is probably 90-95% of the quarantined items during these attacks. Considering having that set to delete instead of quarantine. Don't like the idea of doing that since it will also destroy any valid NDR's that are coming in. The quantities of NDR's being quarantined throw the usefulness of the quarantine right out the window however.

[AndrewT]

I really don't think you will get any better than what can be had with those two. You may simply want to adjust the content filter to also catch the key subject phrases in the ones that are still getting through.

There isn't a good choice as far as handling these undeliverables though. On one hand, one of them might be legitimate but on the other - is anyone actually going to look through them all to check?

[CasualObserver]

That's pretty much how I feel, that it won't get much better then the way it is with Postini and that Postini is a solid product.

One client is driving me crazy with that Sunbelt Ninja product. Someone referred him to it and he thinks it will cure every problem after reading their sales slick on the website. Trouble is, I support the client as a complete site, all hardware / software and services support so sounds like I am going to get to install and configure that beast if nothing else to prove to him it's no better then Postini. Of course, they also thought they could just install it on one workstation to test it and didn't need my help to do it.

Thanks for your time Andrew, appreciate it.