Heads-up: AT&T apparently going to whitelist-only inbound mail

Return-Path: <rm-antiattspam@ems.att.com>
Message-ID: <3F80414B002D0EC2@attrh0i.attrh.att.com> (added by
postmaster@attrh1i.attrh.att.com)
Content-Disposition: inline
Content-Transfer-Encoding: binary
Content-Type: text/plain
MIME-Version: 1.0
X-Mailer: MIME::Lite 2.102 (B2.12; Q2.03)

This is apparently already in place, as it explains why all of my AT&T emails bounced
today.

I guess it they don't want any _new_ customers.

It sure looks to me that they are referring to outbound (from the
customer, through AT&T, to the Internet) mail only.

Presumably this means they are going to either block all 25/tcp from their
customers except from those addresses on their list. Alternatively they
might be routing all outbound customer mail from non-whitelisted machines
through a transparent proxy; possibly the proxy would rate limit the
amount of mail being allowed.

Tony Rall

Wow, this sounds like a pretty extreme shotgun approach. (or is it April 1st somewhere). Is AT&T going to make this whitelist publicly available ? Perhaps if there was some global white list that everyone could consult against, it might be a little more useable. Still, what do you do about multi-stage relays ?

         ---Mike

Here is my experience (names are changed to protect...) :

Failed to deliver to 'AAA@att.com'
SMTP module(domain att.com) reports:
  message text rejected by ckmsi2.att.com:
  550 5.7.1 Your message was rejected as possible spam. Please call your AT&T contact. [3]

Failed to deliver to 'BBB@att.com'
SMTP module(domain att.com) reports:
  message text rejected by ckmsi2.att.com:
  550 5.7.1 Your message was rejected as possible spam. Please call your AT&T contact. [3]

Failed to deliver to 'CCC@att.com'
SMTP module(domain att.com) reports:
  message text rejected by ckmsi2.att.com:
  550 5.7.1 Your message was rejected as possible spam. Please call your AT&T contact. [3]

Failed to deliver to 'DDD@att.com'
SMTP module(domain att.com) reports:
  message text rejected by ckmsi2.att.com:
  550 5.7.1 Your message was rejected as possible spam. Please call your AT&T contact. [3]

Failed to deliver to 'EEE@att.com'
SMTP module(domain att.com) reports:
  message text rejected by ckmsi2.att.com:
  550 5.7.1 Your message was rejected as possible spam. Please call your AT&T contact. [3]

I'm getting nothing but timeouts at this point to any of att's mail servers.
Nothing going through at all.

Jeff Wasilko wrote:

What AT&T is asking is for you to help AT&T to restrict incoming mail
to just our known and trusted sources (e.g., business partners, clients
and customers). Therefore, we need to know which IP address(es) are
used by your outbound e-mail service so we can selectively permit them.
Please send this information to the following e-mail address
(rm-antiattspam@ems.att.com).

And none of AT&T's legitimate business partners, clients, and customers
have dynamic IP addresses? None of them go home and relay through their
home ISP? Or use YourFreeFlyByNightWebMailPopUpAdSite.com when off site?

I mean dealing with spam and email borne worms costs money, but I cannot
imagine how much $$$ in administrative overhead this policy will cost.
This is going to burn many man-hours to build and then to maintain forever
and ever and ever.

Any AT&Ters on this list know the inside story? And I would think something
like this will show up in the trade rags if not the techology section of
mainstream media outlets. Anyone seen anything (or should I wait for it to
hit /.)?