antiabuse.gby

Size: px

Start display at page:

Download "antiabuse.gby"

ぜんぺいよどぎみ
5 years ago
Views:

1 ( ) kazu@iij.ad.jp 1

2 Bot Outbound port blocking (OPB) OPB DKIM SPF SPF SPF

3 3

4 Bot ISP/ASP Bot ( ) 4

5 Bot ( ) PC Bot ( ) Robot

6 Bot ランダムポート PC PC Bot Windows IP 4 SMTP 6

8 Bot

9 p a Outbound port blocking (OPB) Bot (SMTP AUTH) (SPF + DKIM) 投稿ユーザ認証配送ドメイン認証 e. l p m a x e i l e c 9

10 配送配送配送配送 = ( ) = ( ) Submission SMTP 10

11 投稿ユーザ認証投稿配送ユーザ認証配送 POP before SMTP 11

12 OPB ブロック投稿ユーザ認証配送ユーザ認証投稿配送 IP IP 1

13 ブロック投稿ユーザ認証配送投稿ユーザ認証配送 Bot 13

14 ブロック投稿レート制御配送投稿レート制御配送 14

15 ( ) ( ) SMTP IP SMTP IP SMTP user unknown 1

16 ブロック投稿ユーザ認証レート制御配送ドメイン認証投稿ユーザ認証レート制御配送ドメイン認証 16

17 ( ) (reputation) IP cloudmark.com % dig iij.ad.jp.rating.cloudmark.com txt iij.ad.jp.rating.cloudmark.com. 1M IN TXT "Status: Good" iij.ad.jp.rating.cloudmark.com. 1M IN TXT "Rating: 100" 1

18 ISP/ASP ドメイン認証レピュテーションコンテンツフィルタ 1

19 OPB 19

20 OPB 動的 IP 携帯事業者 hi-ho NTTPC KDDI IIJ WAKWAK(NTT-ME) SANNET Nifty AT&T Bell CA Bell South Comcast Earthlink MSN... Blocking.aspx 0

21 () () 1

22 SMTP over SSL SSL SMTP TLS SMTP SMTP over SSL 46 SMTP over SSL Cisco IETF SMTP over SSL ISP/ASP 46

23 SMTP/Submission over SSL/TLS Submission over TLS ( ) SMTP over SSL ( 46 ) SMTP over TLS ( ) ISP/ASP 3

24 4

25 IP SPF (Sender Policy Framework) SMTP MAIL FROM DKIM (DomainKeys Identified Mail) (From:) + IP DKIM

26 1 1 SPF (Sender Policy Framework) (SPF RR, TXT RR) example.jp IN TXT "v=spf1 +ip4: all" IP SPF 1) SMTP IP ) SMTP MAIL FROM 3) DNS IP 4) IP 6

27 "+" pass SPF "all" "?" neutral SPF RR "~" softfail neutral fail "-" fail example.jp IN TXT "v=spf1 +ip4: all" exmaple.jp IN TXT "v=spf1 +a +mx ~all" exmaple.jp IN TXT "v=spf1 -all" Web

28 DKIM Yahoo! Cisco Yahoo! DomainKeys Cisco Identified Internet Mail (IIM) DKIM-Signature: a=rsa-sha1; c=simple; d=example.jp; s=test; t=113131; x=113611; q=dns; h=domainkey-signature:received:dkim-signature: DomainKey-Signature:Received:Message-ID:Date:From:Organization: User-Agent:MIME-Version:To:Subject:References:In-Reply-To: Content-Type:Content-Transfer-Encoding:Reply-To; b=ktdmqpirklgajbalhscji+mx+h6upbrxrcwm4pcw6bcowjtfdl9 4LddNDq+iDGfT3m3Awe6j+UmLIxpc0ET1dny0ut4H9I40CQnjTo9 AahlUYkKeKXQZhTwUPraJMBXFm= DNS DNS (CA)

29 DKIM 公開鍵秘密鍵公開鍵署名検証 DNS 9

30 ドメイン認証結果をヘッダへ受信拒否破棄フィルタリング Authentication-Results: mx.example.com spf=fail 30

31 WIDE JPRS 006 SPF =.4% DKIM = 0.0 % 31

32 SPF 3

33 SPF 33

34 SPF SPF (user unknown) SPF (fail / softfail) (1a) softfail "~all" (softfail) 34

35 u f s i n w o n k n u r e s u l l l o o p s ISP 3

36 u f s i SPF n w o n k n u r e s u l l l o o p s (1b) SPF fail softfail user unknown SPF RR "~all" 36

37 SPF IP SPF "~all" softfail "-all" fail 3

38 SUBMITTER MAIL FROM: SRS MAIL FROM: SMTP SMTP 3

39 MAIL FROM () MAIL FROM SPF (pass) SMTP 39

40 ( () ) 40

41 () SPF

42 (a) (a) 4

43 (a) ) ) 43

44 (b) (b) MAIL FROM "<>" 44

45 (b) ) ) 4

46 u f s i (1) n w o n k n u r e s u l l l o o p s () SPF 46

47 u f s i () n w o n k n u r e s u l l l o o p s () SPF (a) (b) (a) (b) 4

48 SFP SPF SPF RR "~all" ( 1a) Softfail/fail ( 1b) MAIL FROM ( ) SPF ( a, b) SPF "Fail" "Softfail" "~" "-" 4

49 49

50 Submission OPB SPF (SMTP AUTH) OPB SPF RR "~all" SPF SPF fail/softfail uknown user DKIM DKIM DKIM 0

51 IAjapan JEAG WIDE antispam WG 1

( )

( ) ( ) kazu@iij.ad.jp 2 example.jp 投稿ユーザ認証配送ドメイン認証 alice @ example.jp ISP/ASP ISP/ASP? ISP A ISP B ASP C (bot) ISP A ISP B 配送配送 ASP C 配送配送 = ( ) = ( ) Submission SMTP ISP A ISP B 投稿ユーザ認証配送 ASP C