coping with your junk mail

©Copyright CanadaEmails.com 2002-2005

1. Introduction

This document describes CanadaEmails.com policy and methods for dealing with and reducing the amount of junk Email. The spam tolerance level of more and more individuals and network managers is rapidly decreasing. At the same time the volume of SPAM is increasing enormously.

2. Scope of this document

The document describes reasons for and technical issues of spam prevention.

3. Background

What is Spam?

An electronic message is "spam" IF: (1) the recipient's personal identity and context are irrelevant because the message is equally applicable to many other potential recipients; AND (2) the recipient has not verifiably granted deliberate, explicit, and still-revocable permission for it to be sent; AND (3) the transmission and reception of the message appears to the recipient to give a disproportionate benefit to the sender.

email spam is also called Unsolicited Bulk Email (UBE).

Unsolicited means that you lack affirmative consent from the recipient. If you found an address on a web page, on a mailing list, or on Usenet, you don't have consent. If you got an address in gift, sale or trade, you don't have consent. If someone gave you an address for a particular purpose (for example, a commercial transaction, information about your products, or after-sales support) you only have consent to use it for that particular purpose. Use for any other purpose requires a new consent.

What is the impact of spam?

It is high volume, i.e. people get a lot of such mail in their mailboxes.

It is completely "blind", i.e. there is no correlation between the receivers' areas of interest and the actual mail sent out (at least if one assumes that not everybody on the Internet is interested in porno pictures and spam programs...).

It costs real money for the receivers. Since many receivers pay for the time to transfer the mailbox from the (dialup) ISP to their computer they in reality pay real money for this.

It costs real money for service providers. Assume one 10 Kbytes message sent to 10 000 users with their mailboxes at one host; that means an unsolicited, unexpected, storage of 100 Mbytes. As a modest example, a 4 Gbyte raid array can take 40 such message floods before they are filled. It is almost impossible to plan ahead for such "storms".

Many of the senders of spam are dishonest, e.g. hide behind false return addresses, deliberately write messages to look like they were between two individuals so the spam recipient will think it was just misdelivered to them, say the message is "material you requested" when you never asked for it, and generally do everything they can without regard to honesty or ethics, to try to get a few more people to look at their message.

In fact some of the spam-programs take a pride in adding false info that will "make the ISPs scratch their heads".

It is usually the case that people who send protests (often according to the instructions in the mail) find their mail addresses added to more lists and sold to other parties.

It is quite common practice to make use of third party hosts as relays to get the spam mail sent out to the receivers. This theft o f service is illegal in most - if not all - countries ( in the US spammers have been successfully sued). However, with the original sender in the US, the (innocent) relay in Sweden and the list of receivers in Canada, the legal process of getting damages from the spammers becomes extremely difficult.

Junk Email has gained notoriety in recent years due to two factors:

1. increased use of Email as a common form of interpersonal and corporate communication
2. deliberate exploitation of weaknesses of the underlying protocol (SMTP).

The former means that more and more ordinary people (as opposed to computer experts) have access to and regularly use Email, making it a potentially very attractive advertising medium. The protocol has had assorted loopholes since the very beginning, but in the 'good old days' they were either left conscientiously unexploited or put to good use by Internet developers.

In particular in the days of restricted connectivity it was a common practice to pass on a 'difficult' message to a third party with better resources, more comprehensive routing tables etc. which would deliver it to the final destination. Network administrators used this trick to debug mail connectivity and to route around known mail problems.

Nowadays virtually the same technique is frowned upon as it is used almost exclusively to steal the third party's resources and conceal the identity of the real sender. The concealment is made even easier by the fact that SMTP, as originally designed, was assumed to be used between honest sites and users thus making no attempts at the verification of sender's identity or location. A key related issue is the exploitation of ADSL and broadband internet users whose machines are constantly connected to the internet.

The situation reached the point where it was considered desirable to issue an RFC document (RFC2505) describing the best current practice for Mail Transfer Agents (MTAs) to make them less vulnerable to spam attacks.

4. Steps Taken by CanadaEmails.com to prevent Spam

The electronic equivalent of junk paper mail is quite often referred to as 'spam', or more technically as 'UCE' (Unsolicited Commercial Email') or 'UBE' (Unsolicited Bulk Email). Strictly speaking, these terms are not really interchangeable, but in practice they are treated as synonymous. Some mass mailings advertise genuine products, but most spam messages, sent to thousands of random addresses, describe various 'get rich quick' (usually multi-level marketing) schemes, services of dubious taste and legality etc. There are various products on the market facilitating distribution of such messages, using addresses obtained without owners' knowledge or consent, these addresses being bought and sold in massive lists. Usually the mass-mailers use diverse tricks to hide the real identity of the sender.

1. CanadaEmails uses the strict implementation of the Sender Policy Framework (SPF) both for inbound and outbound mail.
2. CanadaEmails.com operates its own Real Time Black Hole (RBL) DNS servers as well as being a secondary server for numerous other RBLs. In this manner, new spammers are blocked as they are detected by any number of the thousands of reporting statins around the world.
3. CanadaEmails.com servers employ relay filtering; mail content filtering, sender checking, recipient filtering; and remote host authentication to maintain a high standard of security for our user accounts.
4. CanadaEmails.com publishes a list of detected spammers to the World Wide Web community, reports traced spammers to law enforcement authorities, and takes other disciplinary actions. This same list is blocked from access to CanadaEmails.com servers.
5. A strict set of content filters is applied to all incoming packets. This filtration includes virus patterns; foul language, and key strings that apply to known spam content. Any Email message containing such content is rejected and the connection is immediately terminated. (In some rare cases users may find that a sent Email is rejected on the basis of content. If this happens you will know immediately. Check your spelling and choice of words and then resend the message.
6. Attachment filtering is applied to all emails transmitted and received. If you need to be sending an attachment of a certain type and it is being blocked, prior approval can be arranged by contacting the postmaster at canadaemails.com. 

Unfortunately, spam costs the sender very little - most of the charges are paid for by the recipient or the carrier rather than by the sender.

There is very little one can do to stop all spam reaching Email accounts. Our goals are therefore to:

• create the best possible technology to provide a secure service;
• educate users how to deal with spam;
• educate users how to reduce proliferation of their Email addresses; and
• prevent spammers from using legitimate mailing lists.

5. Anti-spamming policy

5.1. Unacceptable use

CanadaEmails.com users should be informed that the following actions are contrary to the acceptable use policy and will not be tolerated:

1. sending unsolicited advertising Email using their CanadaEmails.com account;

2. sending unsolicited bulk Email (including chain letters) using their CanadaEmails.com account;

3. attempting to conceal sender's identity or forge mail headers using their CanadaEmails.com account;

4. subscribing anyone to a mailing list without their permission;

5. sending to mailing lists material irrelevant to the purpose of the list;

6. setting the 'Reply-To:' field to somebody else's address at CanadaEmails.com; without their permission;

7. denial of service attacks, e.g. sending multiple very large Emails with the purpose of overloading CanadaEmails.com resources;

8. sending Email designed to damage the receiver's system (e.g. containing viruses);

9. sending Email with illegal content, as defined by relevant jurisdictional; statutes.

While some of these acts (particularly the last two) are not considered spamming in the strict meaning of the word, it makes sense to keep the list of prohibited activities together.

To underline the seriousness of these points it should be made clear that most of them are not only disciplinary offences, but are also unlawful and subject to criminal, civil and extra-legal action.

5.2. Dealing with incoming spam

CanadaEmails.com users should be advised,

1. that ignoring spam is the best policy in most cases;

2. that one cannot expect, on grounds of the cost-to-benefit ratio, to eliminate all unsolicited messages;

3. not to overreact: it takes only one keystroke or mouse click to delete an unwanted message;

4. not to reply to spam, even when a procedure for removal from a mailing list is given (spammers use this ruse to confirm that the address is still valid and active, making it more valuable in future mass mailings);

5. not to take any action implied in the spam message (e.g. distribute virus warning); and

6. report serious cases of spam attacks (e.g. deeply offensive or illegal contents, denial of service attacks) to CanadaEmails.com.

An address for reporting Email abuse has been set up for CanadaEmails.com in accordance with RFC2142.

Home

Copyright 2003