The status of null-sender spam from

February 28, 2016

Recently, David left a comment on my last entry on null sender spam from noting that his site had seen a stop of null sender spam from Outlook at the end of December. This made me curious about what we're seeing (and David asked, too), so I've now gone looking.

The short version is that clear null sender spam from appears to have stopped at the end of last year (and I mean literally the end of last year, as we have entries from December 31st). We're still getting some amount of email from with null sender addresses, but our anti-spam system now scores all of it very low. I can't be sure that this isn't spam, but it's certainly entirely possible that it's real bounces. We continue to get spam from in general; at the moment, our 2016 figure is that about 4% of email from scores high enough to be considered spam. In December the logs say it came out to be about 11.5% spam, so we clearly saw a significant drop here.

David also reported a lack of general spam from Unfortunately we don't see that. has been consistently sending us some amount of spam (as scored by our systems). In addition, several hosts are currently on the SBL; out of microsoft's listings, I can spot more than five listings. However the SBL seems to be doing something odd here, in that they're listing .0 addresses in the /24 instead of the actual IP address they list in the SBL listings. The net effect is that nominal SBL listings won't actually block anything, which kind of irritates me.

(Eg, SBL273948 says 'Spam source @' but is for

My overall view is that continues to have a spam problem, but they have apparently managed to block or otherwise stop one source of their spam. This is progress; it is just not enough progress. Having roughly one in twenty email messages that we receive from you being spam is not a good ratio. For scale, over the same period in 2016, only 0.2% of the email received from Google was scored as spam.

(This includes both GMail email and email from some other things at Google that send out email, since as far as I know you can't tell the email servers apart, assuming there even is different infrastructure for the various different email systems.)

Written on 28 February 2016.
« Link: A Short History Of Removable Media Behind The Iron Curtain
Sometimes, doing a bunch of programming can be the right answer »

Page tools: View Source, Add Comment.
Login: Password:
Atom Syndication: Recent Comments.

Last modified: Sun Feb 28 02:33:51 2016
This dinky wiki is brought to you by the Insane Hackers Guild, Python sub-branch.