A bug in the system, or why ISPs should use SPF


I awoke this morning to see numerous emails in my personal inbox reading:

To: dewitt@gmail.com From: nnnnnnnnnn@vtext.com Subject: Stop texting me!

Now obviously I'm not spam texting anyone. Not via the phone, not via email. But Verizon runs an email-to-SMS gateway at text.vzw.com that allows anyone to send an email to nnnnnnnnnn@vtext.com, where nnnnnnnnnn is a mobile number. It simply forwards the subject line of an email to a mobile number over SMS.

Arguably a useful service, but it is absolutely insane to run it without any form of verification or spam protection.

But because of this, spammers are able to send out tens of thousands of spam text messages with forged From headers and everyone who receives them (perhaps at a cost of $0.10 or more charged to the recipient!) and the blame is redirected on to someone else.

Verizon, please look into implementing the Sender Policy Framework on your email to SMS service. The major email providers support it now, you should use it. You're hurting your customers otherwise and making the problem worse.

This blog post suggests that many, many people are being spammed, and the spam points people to the man555.com domain.

Update: They're hitting T-Mobile's email-to-sms gatesways as well.

If you find this post searching for man555.com or dewitt@gmail.com please know that my heart goes out to you. Spam sucks, SMS spam sucks worse, and I wish there was something I could do to help. Just know that I have nothing to do with this.