Re: AOL email concerns for nodak.edu (fwd)

[Joe St Sauver <JOE () OREGON UOREGON EDU>]

Dick Jacobson <Dick.Jacobson () NDSU NODAK EDU> wrote:

#Below is a letter supposedly from AOL telling us our domain is not playing
#nicely.  Is anyone else seeing these ?

Although it is impossible to say for sure w/o talking with AOL (or at leas
seeing full headers), it is quite likely that that is a real note, and yep,
other folks have seen 'em from time to time.

#I know we send our share for garbage from compromised computers, but most
#of the complaints regarding thos incidents include timestamps or email
#headers so they can be tracked.  This email simply says we are being
#naughty (without any documentation) and they are going block us if we do
#not clean up our act.

If you sign up for AOL SCOMP (spam complaint feedback system), you can see
what's triggering the imminent listing notice. It may be spam zombies, it
may be people who've been avolitionally added to mailing lists, it may be
spam from off site that has been forwarded (along with everythng else) as
a result of traditional .forward-style forwarding service, or (most likely)
a combination of the above.

#I am tempted to treat this as SPAM and submit a complaint to the origin
#(appears to be in the AOL domain but I have not torn into the headers too
#deeply).

Might be a temptation, but I'd probably resist. AOL *has* blocked .edu's
for what they believe to be unacceptable spam levels, and when that happens,
it tends to be rather painful due to the size of their customer base,
particularly if it happens around the time that admissions related emails
would normally be happening (e.g., you may have a fair number of applicants
using AOL email addresses for admissions-related correspondence).

I'd suggest:

-- sign up for scomps at http://postmaster.info.aol.com/fbl/fblinfo.html
   (caution: be prepared for substantial potential volume, and initially
   you might want to limit the age of complaints you accept)

-- because the scomp report format is not ideal, you might want to look
   at automated rewriters, such as http://word-to-the-wise.com/scompfilter/

If, after looking at the complaints you're seeing, it becomes clear that
you're mostly dealing with spam zombies (e.g., correctly targeted spam
complaints from AOL), the conventional solution is to take those hosts
off the air and clean 'em up. (easily said, I know, painful in practice).
You may also want to try the strategy I outlined for the Messaging
Anti-Abuse Working Group (MAAWG) at:

-- Spam Zombies and Inbound Flows to Compromised Customer Systems
   http://darkwing.uoregon.edu/~joe/zombies.pdf

No single solution will be right for everyone.

If the scomps are associated with forwarding, I'd suggest looking at

-- The Impending End of Traditional .forward-style Forwarding
   http://www.campus-technology.com/news_article.asp?id=10313&typeid=153

to see if that describes what's going on.

If on the third hand, :-), a lot of what you're seeing is spam complaints
associated with list traffic that folks don't want, you may want to review
how folks are getting added to campus mailing lists, or consider something
like periodic list reconfirmations, with the default for non-confirmation
being "unsubscribe"

Regards,

Joe

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/groups/.