Subject: [dmarc-ietf] First wave of DMARC-compliant spam?

From: Andy Wilson <[email-masked]>
Date: Wed, 17 Apr 2013 10:16:05 +1200

I got some spam recently with interesting characteristics; it passed DKIM,
SPF and DMARC with a reject policy.

Authentication-Results: mx.google.com;
       spf=pass (google.com: domain of [email-masked]
designates 142.234.235.23 as permitted sender)
smtp.mail=[email-masked];
       dkim=pass header.i=[email-masked];
       dmarc=pass (p=REJECT dis=none) d=clientbasics.com

It's obvious spam, and ended up in my spam folder (even though AR says
dis=none)

I wonder if spammers are starting to use DMARC to gather aggregate feedback
on policies applied by mailbox providers?

I suppose it could be a compromised account, although following the WHOIS
points to an email address for mediatraffickers.com which looks spammy to
me..

-- 
Regards

Andy

---

From: Elizabeth Zwicky <[email-masked]>
Date: Tue, 16 Apr 2013 22:46:33 +0000

I'm afraid it's about a year too late to identify the first wave of DMARC-compliant spam.

I love spammers who use DKIM and DMARC. Please, let me be precise about your reputation.

Elizabeth

From: Andy Wilson <[email-masked]<mailto:[email-masked]>>
Date: Tuesday, April 16, 2013 3:16 PM
To: "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>
Subject: [dmarc-ietf] First wave of DMARC-compliant spam?

I got some spam recently with interesting characteristics; it passed DKIM, SPF and DMARC with a reject policy.

Authentication-Results: mx.google.com<http://mx.google.com>;
       spf=pass (google.com<http://google.com>: domain of [email-masked]<mailto:[email-masked]> designates 142.234.235.23 as permitted sender) smtp.mail=[email-masked]<mailto:[email-masked]>;
       dkim=pass header.i=[email-masked]<mailto:[email-masked]>;
       dmarc=pass (p=REJECT dis=none) d=clientbasics.com<http://clientbasics.com>

It's obvious spam, and ended up in my spam folder (even though AR says dis=none)

I wonder if spammers are starting to use DMARC to gather aggregate feedback on policies applied by mailbox providers?

I suppose it could be a compromised account, although following the WHOIS points to an email address for mediatraffickers.com<http://mediatraffickers.com> which looks spammy to me..

--
Regards

Andy

---

From: Terry Zink <[email-masked]>
Date: Tue, 16 Apr 2013 22:48:22 +0000

Doesn’t this make it easy to filter in the future? Just add “clientbasics.com” to a domain blocklist?

While spammers may be trying to see how reject policies are used currently, they may just be trying to imitate a good sender and assume that authenticating with DKIM and/or SPF means easier deliverability to the inbox.

-- Terry

From: [email-masked] [mailto:[email-masked]] On Behalf Of Andy Wilson
Sent: Tuesday, April 16, 2013 3:16 PM
To: [email-masked]
Subject: [dmarc-ietf] First wave of DMARC-compliant spam?

--
Regards

Andy

---

From: Olga Gavrylyako <[email-masked]>
Date: Wed, 17 Apr 2013 07:06:52 -0700

Yes... unfortunately nothing new ...
Olga

On Tue, Apr 16, 2013 at 3:48 PM, Terry Zink <[email-masked]>wrote:

>  Doesn’t this make it easy to filter in the future? Just add “
> clientbasics.com” to a domain blocklist?****
>
> ** **
>
> While spammers may be trying to see how reject policies are used
> currently, they may just be trying to imitate a good sender and assume that
> authenticating with DKIM and/or SPF means easier deliverability to the
> inbox.****
>
> ** **
>
> -- Terry****
>
> ** **
>
> *From:* [email-masked] [mailto:[email-masked]] *On Behalf
> Of *Andy Wilson
> *Sent:* Tuesday, April 16, 2013 3:16 PM
> *To:* [email-masked]
>
> *Subject:* [dmarc-ietf] First wave of DMARC-compliant spam?****
>
> ** **
>
> SPF and DMARC with a reject policy.****
>
> ** **
>
> Authentication-Results: mx.google.com;****
>
>        spf=pass (google.com: domain of [email-masked] designates 142.234.235.23 as permitted sender) smtp.mail=[email-masked];****
>
>        dkim=pass header.i=[email-masked];****
>
>        dmarc=pass (p=REJECT dis=none) d=clientbasics.com****
>
> dis=none)****
> ** **
> I wonder if spammers are starting to use DMARC to gather aggregate
> feedback on policies applied by mailbox providers?****
>
> ** **
>
> me..****
> ** **
> ** **
> Andy ****
> _______________________________________________
> dmarc mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/dmarc
>
>

---

From: "Rock, Paul" <[email-masked]>
Date: Wed, 17 Apr 2013 15:07:19 +0000

Yes and no. They'll likely abandon that domain in a day or two now that he's done his spam run, if they haven't already. Here at AOL we've seen 10+ million new domains pop up since the first major DMARC press release with reject policies, which tells us that DMARC has been added to whatever scripting tools they're using to setup new domains.

Paul Rock
Senior Programmer/Analyst | Mail Abuse Operations
P: 703-265-5734 | C: 703-980-8380
AIM: PaulSRock
44900 Prentice Drive | Dulles, VA | 20166

On Apr 16, 2013, at 6:48 PM, Terry Zink <[email-masked]<mailto:[email-masked]>>
 wrote:

Doesn’t this make it easy to filter in the future? Just add “clientbasics.com<http://clientbasics.com>” to a domain blocklist?

-- Terry

From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]<mailto:[email-masked]>] On Behalf Of Andy Wilson
Sent: Tuesday, April 16, 2013 3:16 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [dmarc-ietf] First wave of DMARC-compliant spam?

--
Regards

Andy
_______________________________________________
dmarc mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/dmarc