Thursday, 6. November 2003

Calculating the cost of false positives
It is true. Occasionally I get a complaint from a user here that some company or individual is having email rejected by us. It used to be the case that all complaints were to do with DNSBL listings. Now it is more often the case that we have the sending IP or host blocked locally.
So,
Stoomaroo wants to know, "do you take into account the time/communications issues lost to false positives?"
Well, no actually.
No, it's not that I don't want to. I am actually very keen on keeping stats and analysing them to spot new trends or to assess the effect of new countermeasures. It is just that the absolute number of such complaints I get is very small. Two last month, and one of those was an old fashioned open relay which we were able to help close and have delisted by the relevant DNSBLs, thus probably saving time and disruption - at least from the remote sender's point of view. The other was trying to send direct-to-MX from a dynamically assigned IP and this is an increasingly bad idea.
So, despite a pretty high kill rate, the amount of time lost to false positives here remains small enough that I don't have to measure it. Hope that answers the question, though at least two more questions follow on:
- Why is sending direct-to-MX from a dynamic address a bad idea? -- and
- Why is a whitelisting delivery model looking more and more attractive?
Future blog topics, both.
Category: Spam miscellany
Technorati: Spam miscellany