Unacceptable: Forced to use WBS's SMTP server

[shunt]

smtp.wirelessza.co.za

Hi,

Just to clear up something earlier, smtp.wirelessza.co.za was setup by Tradepage, so our Iburst clients could relay through it.

We recently changed it to a CNAME to smtp.wbs.co.za, this way when Iburst blocked all outgoing mail unless to smtp.wbs.co.za it would continue working for our clients with smtp.wirelessza.co.za as there outgoing mail server

Thanks,
Michael
www.Wirelessza.co.za

 

[regardtv]

pop3 external to WBS is horific ....

Running on a non-standard port works ... so something is fubar ... And it's not internal to wbs as far as I can see ....

 

[jmn]

Mail (POP3 & IMAP) are about the only things that are OK for me now Last month I battled with mail after being capped. (External servers)

 

[inso]

MUHAHAHAHAHA it wouldn't end spam, just force it to evolve. The only way to stop spam is to make spam illegal and then enforce that law. This needs to be done on a world wide scale, not just national govt level.

Uh-huh. Just as these laws are having an amazing impact in the US. No amount of law enforcement will fix this problem, cause the scumbags just migrate to new countries, like China.

Anyway this has been tried by adding dynamic IP addresses (like the ADSL users) to blocking lists.If all dynamic IP addresses were added to blocking lists and everyone used it, it would accomplish the same thing.

There is no one-fix solution. RBLs are just one of many tools you should be using; forcing ISP users to channel outgoing mail through one server isn't the end of the world, contrary to all the other drama queens' responses here. If you have a hosted box, set up TLS on it and use port 465. Or let your plain SMTP server listen on another port as well, or do it in your firewall. Sheesh. There's always ways around a problem, which is the way the internet evolves.

 

[inso]

1) 10MB max per email (will be increased this week but still not enough)

This is NOT a valid reason. Email was NEVER designed as a file transfer method, and MIME was just tacked onto it in order to support it. People like you make we want to go postal; I enforce 2MB on all my mail servers, since anything over that is bloat (ie., one of those 7mb WMV forwards, bloated word docs, etc). Use compression! Use PDFs!

3) Not willing to adjust my domain's SPF (anti-spam) settings to use wbs

What kind of a crap setup do you have, where a line of text is difficult to effect?

The only reason this could be a bad move is if their mail server is flakey.

 

[TheRoDent]

This is NOT a valid reason. Email was NEVER designed as a file transfer method, and MIME was just tacked onto it in order to support it.

Agreed about the size of emails et al, but it is, in the end, the end users' bandwidth to do with what he pleases. Plus, large mime emails work, and nowhere does the standard say there's a size limitation or that it's not allowed to be used for filetransfer. It is thus, an entirely valid reason.

What kind of a crap setup do you have, where a line of text is difficult to effect?

He has the kind of setup that worked before WBS started this madness.

The only reason this could be a bad move is if their mail server is flakey.

220 Welcome [][196.4.x.x] to the WBS flakey mail cluster. Host: mail-01.jhb.wbs.co.za, Cluster Node: 1

 

[TheRoDent]

Spamhaus listing for wbs: http://www.spamhaus.org/sbl/listings.lasso?isp=wbs.co.za

I think the picture becomes clearer now. Does anyone think WBS responds to abuse@wbs.co.za? Considering that they hardly read the helpdesk email, the probably got warned about the listing, ignored it, or never read, got that /32 (single ip) spamhaused because they didn't take action against the subscriber that was spamming 419.

So they decided that the best thing to do was to just remove SMTP access from everyone.

 

[slimothy]

no, its bad move because now the domain the email originated from and the domain that the sender put in the headers arent the same, so unless, inso, you can control every spam scanner in the world, its not cool

 

[slimothy]

Spamhaus listing for wbs: http://www.spamhaus.org/sbl/listings.lasso?isp=wbs.co.za

I think the picture becomes clearer now. Does anyone think WBS responds to abuse@wbs.co.za? Considering that they hardly read the helpdesk email, the probably got warned about the listing, ignored it, or never read, got their ip range spamhaused because they didn't take action against the subscriber that was spamming 419.

So they decided that the best thing to do was to just remove SMTP access from everyone.

actually that email address is owned by gary waterworth i believe, he is a normal iburst user

 

[TheRoDent]

ROFL. Gary, bud, did you get any notifications there mate?

 

[inso]

no, its bad move because now the domain the email originated from and the domain that the sender put in the headers arent the same, so unless, inso, you can control every spam scanner in the world, its not cool

Eh? Email doesn't "originate from a domain" -- it has an envelope that contains details of the sender, recipient, etc. There's no RFC that specifies that there should be any correlation between the From: address and the domain/netblock it is originating from, or the first Received: server line.

And people who use brain-dead spam scanners that rely on some heuristic like that should suffer for it. I've got no sympathy for them, cause there are proven better ways, as I mentioned in an earlier post.

 

[inso]

Agreed about the size of emails et al, but it is, in the end, the end users' bandwidth to do with what he pleases. Plus, large mime emails work, and nowhere does the standard say there's a size limitation or that it's not allowed to be used for filetransfer. It is thus, an entirely valid reason.

Large emails work only until they hit a relay server that won't allow them through. Its entirely sane for admins to set up their servers to drop those on the spot. This is not at all an issue about what a user can or cannot do with his/her bandwidth -- this is an issue about being prudent with your service. As you yourself found, they're already listed in an RBL, which will make them receive flak from their users when email start being returned. This move doesn't inconvenience 99.99% of their userbase (excepting a possible one-line change in your MUA), and for the rest: they are (or should be) tech savvy enough to get around it.

He has the kind of setup that worked before WBS started this madness.

That's just timing. A lot of other ISPs do this already, no questions or hubbub about that. I'm sure that wasn't high on anyone's priority list when they decided on iBurst -- simply because it ISN'T an issue.

You already had to set up TXT records for your domain once before; how difficult can it POSSIBLY be to add another one to unbreak SPF? Or to flex your firewall rules a bit. Or just diversify your SMTP server. Eish.

220 Welcome [][196.4.x.x] to the WBS flakey mail cluster. Host: mail-01.jhb.wbs.co.za, Cluster Node: 1

Heh! I wonder how big your cluster needs to be to unflake it.

 

[TheRoDent]

Eh? Email doesn't "originate from a domain" -- it has an envelope that contains details of the sender, recipient, etc. There's no RFC that specifies that there should be any correlation between the From: address and the domain/netblock it is originating from, or the first Received: server line.

You're right, there isn't. But there's a lot of software that uses this information in checking for spam.

And people who use brain-dead spam scanners that rely on some heuristic like that should suffer for it. I've got no sympathy for them, cause there are proven better ways, as I mentioned in an earlier post.

Are you sure you don't work for WBS? You really are supporting them here all the way.

For your information: Spamassassin has a number of rules that consider the "Received:" path chain of an email. This Received: path is now being changed due to WBS forcing mail through their server.

The first, is a score on the time difference between the "Received:" headers. Do we trust WBS to keep their SMTP servers' clocks synchronized? Yeah, we trust them to read their helpdesk email too...

Secondly, spamassassin uses a list of CCTLDS_WITH_LOTS_OF_OPEN_RELAYS, which, not suprisingly, includes ".za". With WBS's forced mail relaying, there will now be TWO Received: headers with a .za domain in the Received: chain. Score more for your email turning into spam.

Thirdly, another score for ROUND_THE_WORLD_RELAYING is done, with an additional weight, using the same TLD's with each instance of the TLD adding more score to the spamminess of your mail.

The more ".za" domains involved in sending your email, the higher the possible spam ranking. Not great if you're using a .com domain to do your business.

Now, you can rant all you want about heuristics and how people using them should die, etcetera, but I know of a great many organisations that make use of Spamassassin, because it works for them. In fact, it's one of the better projects out there.

BTW, mail limit seems to be 15 Meg now.

 

[TheRoDent]

That's just timing. A lot of other ISPs do this already, no questions or hubbub about that.

Please name them, so that we can shame them too. I know DataPro does filtering, but on non-DataPro inbound traffic to their colo only, to offer their customers reasonable protection. It does not affect their end-users' ability to talk to an SMTP server as they see fit.

I'm sure that wasn't high on anyone's priority list when they decided on iBurst -- simply because it ISN'T an issue.

Funny, a lot of people here seem to find it an issue. And they're the ones that are mostly a little more clued up than the average small business user.

You already had to set up TXT records for your domain once before; how difficult can it POSSIBLY be to add another one to unbreak SPF? Or to flex your firewall rules a bit. Or just diversify your SMTP server. Eish.

You're talking about something that a small business guy that uses a US based Colo (because it's cheap) for his hosting and services cannot easily accomplish, without having to pay someone that CAN do it. Never mind the fact that his hosting provider might not be interested at all. I know of MANY small businesses that host their sites, and email abroad due to cost. MyADSL used to be hosted over there, for a long time. We're not talking about enterprises on iBurst that can easily "diversify their SMTP servers".

Heh! I wonder how big your cluster needs to be to unflake it.

Don't know. How big a cluster does it take to not produce 7000ms response times?

 

[TheRoDent]

Large emails work only until they hit a relay server that won't allow them through. Its entirely sane for admins to set up their servers to drop those on the spot.

Yes, and WBS has now made that decision on behalf of their users, instead of giving their users the option to communicate between domains using emails as large as they prefer, without the interference of a relay.

This is not at all an issue about what a user can or cannot do with his/her bandwidth -- this is an issue about being prudent with your service.

Wrong, this is exactly an issue about what a user can or cannot do with their bandwidth. WBS has decided that users can only send emails up to 15Megs in size. If that's not deciding what they can and cannot do with their bandwidth then I don't know what is.

As you yourself found, they're already listed in an RBL, which will make them receive flak from their users when email start being returned.

The way to deal with RBL listings is to remove/disconnect the abusive users from their network, and to request a delisting. This is what prudent ISP's do. Prudent ISP's also read their abuse@ mail.

This move doesn't inconvenience 99.99% of their userbase (excepting a possible one-line change in your MUA), and for the rest: they are (or should be) tech savvy enough to get around it.

There was no "should be tech savvy to circumvent our idiotic measures" clause in the WBS contracts. There's also the fact that people like regardtv, that monitors his clients' servers for availability, or diagnostic purposes can now not talk to their SMTP daemons. Must he now convert all 100 of his clients's firewalls so that he can monitor them on a different port?

No matter which way you swing this inso, it is a Bad Thing (tm).

 

[inso]

I'm consolidating your three replies into one:

Are you sure you don't work for WBS? You really are supporting them here all the way.

I'm not supporting anyone - don't twist my words. If you could see my IP, you'll see that I'm on ADSL. I am, however, considering iBurst and all the other wireless providers, since I'll be moving soon, and ADSL will likely not be an option.

Just because I'm providing a reasoned debate / discussion, do not make assumptions about my loyalties. I'm just as pissed off about the state of affairs in South Africa, but sometimes the sheer level of moaning on this site gets me down.

For your information: Spamassassin has a number of rules that consider the "Received:" path chain of an email. This Received: path is now being changed due to WBS forcing mail through their server.

Umm, no, spamassassin has no concept of what headers are. It uses Bayesian modeling to arrive at a estimate of an email's spamminess. There is no concept of it constructing a Received: path and making deductions from it.

The first, is a score on the time difference between the "Received:" headers. Do we trust WBS to keep their SMTP servers' clocks synchronized? Yeah, we trust them to read their helpdesk email too...

What it *does* in fact check, is whether the date of the email is significantly different from the current time, and then it must be differing by an order of days, not minutes or seconds.

Secondly, spamassassin uses a list of CCTLDS_WITH_LOTS_OF_OPEN_RELAYS, which, not suprisingly, includes ".za". With WBS's forced mail relaying, there will now be TWO Received: headers with a .za domain in the Received: chain. Score more for your email turning into spam.

Thirdly, another score for ROUND_THE_WORLD_RELAYING is done, with an additional weight, using the same TLD's with each instance of the TLD adding more score to the spamminess of your mail.

The more ".za" domains involved in sending your email, the higher the possible spam ranking. Not great if you're using a .com domain to do your business.

That's just patently false. I have just now scanned through all my email logs (which date back considerably), and I've *never* even hit the CCTLDS rule. And I don't relay .co.za email? Bah! All my CLUG email gets tagged as ROUND_THE_WORLD, but it hasn't had any detrimental effects there? That's the whole *point* of using a cumulative rating -- so that the median (ie., those lying close together in the middle) do not get distorted by one or two odd ones. It works, and it works well.

Now, you can rant all you want about heuristics and how people using them should die, etcetera, but I know of a great many organisations that make use of Spamassassin, because it works for them. In fact, it's one of the better projects out there.

I agree completely, and that's why I use it.

Please name them, so that we can shame them too. I know DataPro does filtering, but on non-DataPro inbound traffic to their colo only, to offer their customers reasonable protection. It does not affect their end-users' ability to talk to an SMTP server as they see fit.

I don't use an ISP that does. However, I know that this is standard operating procedure for major US and UK providers, which was the point I was trying to make. South Africa *is* becoming a haven for spammers (why do you think we're on the CCTLD list?) -- why don't you support a move to try and combat that somewhat? I'm not saying its perfect, but it IS a good hurdle that any spammer now needs to overcome.

Funny, a lot of people here seem to find it an issue. And they're the ones that are mostly a little more clued up than the average small business user.

You're talking about something that a small business guy that uses a US based Colo (because it's cheap) for his hosting and services cannot easily accomplish, without having to pay someone that CAN do it. Never mind the fact that his hosting provider might not be interested at all. I know of MANY small businesses that host their sites, and email abroad due to cost. MyADSL used to be hosted over there, for a long time. We're not talking about enterprises on iBurst that can easily "diversify their SMTP servers".

Huh? He said he has set up SPF before, so how would it be difficult to change it again? Does not compute. And we were talking about hosted boxes over which you have that kind of control, not some arb fly-by-night that is reliant on a hosting provider for all their infrastructure. You get what you pay for.

Don't know. How big a cluster does it take to not produce 7000ms response times?

I think you might be mistaken. Don't confuse degradation of service due to your wireless connection with their server infrastructure being bad. Having run mtr against mail-01.jhb.wbs.co.za for a while now (and obviously using the SAIX backbone, although I've verified it from UUNet as well) all the way from Cpae Town, I get consistent ping times of well under 50ms. If you want me to, I can check during the day that it isn't spurious, but it seems fairly stable to me at the moment.

Yes, and WBS has now made that decision on behalf of their users, instead of giving their users the option to communicate between domains using emails as large as they prefer, without the interference of a relay.

Wrong, this is exactly an issue about what a user can or cannot do with their bandwidth. WBS has decided that users can only send emails up to 15Megs in size. If that's not deciding what they can and cannot do with their bandwidth then I don't know what is.

I've never defended their way of doing it; I agree that a few days' notice isn't really the Right Thing(tm) to do. I was arguing for the practice in general.

The way to deal with RBL listings is to remove/disconnect the abusive users from their network, and to request a delisting. This is what prudent ISP's do. Prudent ISP's also read their abuse@ mail.

Certainly. However, you can't now suddenly argue for them to do one prudent thing, but not another.

There was no "should be tech savvy to circumvent our idiotic measures" clause in the WBS contracts. There's also the fact that people like regardtv, that monitors his clients' servers for availability, or diagnostic purposes can now not talk to their SMTP daemons. Must he now convert all 100 of his clients's firewalls so that he can monitor them on a different port?

Again, there are a *lot* of options here. If you feel that you have a business that considers unfiltered access to port 25 a priority, then iBurst / regular ISP access probably isn't for you. Get your own box, with which you *have* that control. And again, you get what you pay for. ISPs in the dialup market *are* more anal, simply because they provide a budget service to a high-maintenance market. Contrast this with a backbone/hosting provider that can charge premium rates for services that is generally self-maintaining.

No matter which way you swing this inso, it is a Bad Thing (tm).

Well, I'll agree to disagree on this one. The concept of forcing SMTP relaying has its place, and does definitely do more good than harm in those circumstances. The needs of the many outweighs those of the few.

 

[seburn]

Originally Posted by seburn
NO!!!!!!!!!
OK so I pay for external email servers So if WBS disallows them:
When i get disconnected I will need to change the smtp setting on all pc to use other smtp and when I am connected I will do the oposite.

Considering that I don't work there everyday and no-one else will know how to do this, we're ******

Anyone know how to route from smtp.ispx.co.za:25 to smtp.wbs.co.za:25 in Ipcop?

I make my point once more... But never mind we are using ISDN perminantly anyway my boss is fed up with Iburst, disconnections in the middle of a Skype call and the inablity to use the service for sometimes entire days is Pathetic. One week sort it out or we chuck it out.

 

[TheRoDent]

Umm, no, spamassassin has no concept of what headers are. It uses Bayesian modeling to arrive at a estimate of an email's spamminess. There is no concept of it constructing a Received: path and making deductions from it.

Perhaps I came across incorrectly with the word "chain". When I said "chain", I meant the set of Received: headers that exist within all emails. I didn't mean to imply that the entire "path" is used in SA's calculations (altho this is true for at least the first two Received: headers)

That's just patently false. I have just now scanned through all my email logs (which date back considerably), and I've *never* even hit the CCTLDS rule.

Have a closer look at the double matching regex and logic in check_for_round_the_world_received. It's ugly, it's perl, it contains goto's, but you gotta love it The statement is not patently false. It is certainly possible.

And I don't relay .co.za email? Bah! All my CLUG email gets tagged as ROUND_THE_WORLD, but it hasn't had any detrimental effects there? That's the whole *point* of using a cumulative rating -- so that the median (ie., those lying close together in the middle) do not get distorted by one or two odd ones. It works, and it works well.

Absolutely agreed. The fact is that WBS is causing a bit more of that rating to occur. Add a bit more HTML to your email, a bit of graphics for a .sig - then what?

I agree completely, and that's why I use it.

Good to hear. It's still one of my favorite projects, considering that it's perl based and all.

I don't use an ISP that does. However, I know that this is standard operating procedure for major US and UK providers, which was the point I was trying to make. South Africa *is* becoming a haven for spammers (why do you think we're on the CCTLD list?) -- why don't you support a move to try and combat that somewhat? I'm not saying its perfect, but it IS a good hurdle that any spammer now needs to overcome.

I entirely disagree that it's a good measure to overcome spammers, and spamming. It is in my view, braindead.

The proper way to deal with it, would have been to put their modem IP range into the MAPS DUL list so that no corporate, or sane SMTP server would even think of receiving mail from them.

Huh? He said he has set up SPF before, so how would it be difficult to change it again? Does not compute. And we were talking about hosted boxes over which you have that kind of control, not some arb fly-by-night that is reliant on a hosting provider for all their infrastructure. You get what you pay for.

Your comment was specific to regardt's case. I was trying to extrapolate it to the fact that "not everyone does this" or has that kind of control over their boxen. And that is a fact. "You get what you pay for" doesn't seem to be the case with iBurst, at the moment. And that, quite frankly is what this discussion is about.

I think you might be mistaken. Don't confuse degradation of service due to your wireless connection with their server infrastructure being bad. Having run mtr against mail-01.jhb.wbs.co.za for a while now (and obviously using the SAIX backbone, although I've verified it from UUNet as well) all the way from Cpae Town, I get consistent ping times of well under 50ms.

Unfortunately, I'm not mistaken. I saw those pings during the course of the first morning. From a pretty nice fat local backbone driven by Diginet, not iBurst. Matt's indicated that it wasn't due to routers amongst they way either. It has obviously calmed down this evening. Who knows what tomorrow holds?

I've never defended their way of doing it; I agree that a few days' notice isn't really the Right Thing(tm) to do. I was arguing for the practice in general.

I think the practice completely sucks. The WBS IP pool should have been entered into the MAPS DUL, as Telkom has done with their ADSL ip ranges, and that should have been the end of that. No sane mailserver that uses a RBL would receive mail directly from them, and that would kerb spam better than anything else. And it would still allow end-users to contact whatever mail server they own/operate without interference.

What exactly is WBS going to do if one of their users simply uses smtp.wbs.co.za to relay spam? How is this helping? Is WBS's mail server simply going to blindly relay their spam? Yay, for spammers, it's just gotten easier. Is WBS going to implement spamfiltering on smtp.wbs.co.za for all relayed mail? Hmmm. That would be even worse.

Certainly. However, you can't now suddenly argue for them to do one prudent thing, but not another.

This, exactly is my argument, I fail to see how this is prudent. Please convince me otherwise, because I feel like I may be missing you on this point. How is forcing all mail through WBS's smtp server that just blindly forwards everything kerbing a lone spammer? Am I missing something terribly obvious? I just don't see it.

Unless we take WBS's "The relaying of bulkmail is discouraged on the iBurst network. Certain restrictive measures will be enforced to ensure that the relaying of bulk mail does not adversely affect other traffic on the network." statement to mean that there may be even MORE limitations on sending mail than what we know of? What, are they now going to limit you to 1 email per minute? Who decides what is "bulk" email? WBS? I hate spam as much as the next guy, but hell, this is getting ridiculous.

MAPS DUL, would have been the most obvious choice to sort this out.

The needs of the many outweighs those of the few.

Ave comrade.

 

[TheRoDent]

The needs of WBS outweighs those of it's customers.

Fixed that one for you.

 

[DFantom]

Its entirely sane for admins to set up their servers to drop those on the spot.

That should be up to the mail admin, not the ISP.

which will make them receive flak from their users when email start being returned

Hell yeah it will. But As I stated in my earlier posts if they come down hard on the offenders then it will cause them to be avoid by spammers. Anyway whats stopping spammers just using the WBS mail server now? And when that gets blocked?

This move doesn't inconvenience 99.99% of their userbase

I would love to know where you dragged that number from. I agree the majority of users will be uneffected by I think you would find the amount of effected users far higher. I'm thinking of people who run there own servers, monitor mail servers, pay for a special mail server setup (i.e. a system which archives all mail, or digitally signs all mail automatically), the WBS resellers who run their own mail servers and all their clients and so on. Yes I agree that at the end of the day the bulk can work around it. My issue is why should they have to?

I'm sure that wasn't high on anyone's priority list when they decided on iBurst -- simply because it ISN'T an issue

Agreed when choosing iBurst personally and recommending to friends/family/clients it wasn't a factor since it wasn't an issue. Now that it is blocked and the way WBS has handled this it is an issue and it is a factor in cancelling iBursts and not recommending it to anyone else.

You already had to set up TXT records for your domain once before; how difficult can it POSSIBLY be to add another one to unbreak SPF?

It's not difficult, but why with very little warning should this be shoved onto people to do.

I don't use an ISP that does. However, I know that this is standard operating procedure for major US and UK providers

Care to name one? I have never seen this practise on an major ISP level, ANYWHERE. I've seen it done in other places before, mostly on a corporate level. But NEVER an "major" ISP level.

it IS a good hurdle that any spammer now needs to overcome

How so? It seems now all the spammers need do is use the WBS mail servers. Which in turn slows them down, makes them less reliable, and gets them blocked. Seems to me that this is a bad move.

how would it be difficult to change it again?

In my case I have to change 30 domain names records for this. I need to test all the records before appling them. I need to generate the SPF information. I need to hope that WBS does not change there IP addresses and mail server domain names without prior warning or it will break the SPF again.
The change itself isn't hard, it's everything else that goes with it thats time consuming and hard.

If you feel that you have a business that considers unfiltered access to port 25 a priority, then iBurst / regular ISP access probably isn't for you.

Agreed. Thats why my servers are hosted at places like IS and UUNet, but my clients can not move their offices into the UUNet server room? They can not afford the costs for diginet. This is what they can afford. It's not about the servers, it's about the users.

The concept of forcing SMTP relaying has its place, and does definitely do more good than harm in those circumstances.

I'm not positive it does. Care to back up that statement with examples/facts?

The needs of the many outweighs those of the few.

Agreed and as stated before this will effect a small number in the long term. But why was it handled so badly? Why is the communication with WBS so bad? The real problem is that communication failed. Had WBS gone to it's client base and said we are thinking of doing this because of the following reasons, it's not a plan but we want to hear your thoughts on it. Then taking those ideas and thoughts and going through them. Sending out another mail (and maybe even posting here) stating this is the common concerns raised, this is how they aim to fix them and this is the time frame (at least 1 month notice) for implementing a decent setup. Then I don't think the outcry would have been so bad. But they didn't and they screwed the pootch.