Home / Blogs

Misconceptions About Spam

Sometimes I hear people or read writers that say things about spam that are incorrect. I thought I would clear those up in this blog post.

1. December is spam season

When the holidays roll around, people start warning other people to watch their inboxes—December is spam season! By that, they mean that more spam than normal flows around the Internet.

People say this because December is the holiday season. Since spam is another form of advertising, and advertisers pepper us with ads during this time, then spammers must do the same.

It makes sense except it’s not true.

There are some years where spammers send more mail, but not every year. To measure this, I compared the month of December’s spam volume to the preceding three months, and the three months following. Below are the results for the past 6 years:

The red text above indicates where spam increased in December and fell off the next few months, which is what we would expect to see if spam really were seasonal.

The graph above shows that sometimes spam increases, but sometimes it doesn’t. It’s not consistent at all, and if it’s not consistent, then you can’t say that December is spam season.

Spam volumes may go down because it’s the holiday season; with more people out on vacation, their computers are turned off (at work) and therefore, the number of bots in the spammers’ botnets are smaller and therefore they send out fewer spam messages.

Whatever the explanation, Christmas is not the spam season.

2. Most spam is about porn

When people tell jokes about spam, they’re either about Viagra (or similar drugs) or about x-rated material. When I first started working as a spam analyst in 2004, I saw lots of x-rated spam. But I noticed that it was a smaller and smaller part of total mail.

In 2009, I started keeping track of categories of spam. Below are the results of how much porn spam accounts for:


It isn’t negligible, but it’s not even in the top 5 (it trails Pharmaceuticals, Products, 419s, Financial [refinance your mortgage, work from home] and Gambling—and has for years). Thus, while spam started out as a way to get people to buy x-rated services, today it’s mostly free. Why buy it (kind of like music and movies)? When that realization sunk in, spammers moved to more profitable ventures.

3. IPv6 is a ticking time bomb and a bonanza for spammers

The primary line of defense in spam filters are IP blocklists. They improve spam effectiveness, save on bandwidth (because you can reject mail at the edge without accepting it), don’t waste server resources filtering unwanted mail, and don’t need mail servers to store spam in a quarantine.

Because IPv6 adds so many IP addresses, it will be impossible to use IP blocklists:

• IPs get onto blocklists because they send spam to honeypots. Because there are so many IPv6 addresses, a spammer could send one spam per IP and then discard it forever. It wouldn’t matter even if they hit honeypots because the IP would never be re-used.

• Even if spammers re-used IPs, blocklists would be so large that back end servers would never be able to store, transfer or process them efficiently.

Since the world is on a march to IPv6, it’s only a matter of time before spammers use it as a floodgate to avoid IP blocklists and mail servers around the world become inundated under spam. The end is near.

Except it’s not true.

It’s definitely true that IPv6 enables more devices to connect to the Internet, but there’s a big difference between connecting to the Internet and connecting to the Internet to send email.

All email receivers know about the two problems I outlined above. Thus, while pointy-haired bosses around the world all want to be on the cutting edge of IPv6 (Look at how state-of-the-art we are!), nobody who receives email is enthralled about potentially receiving it over IPv6.

Because of this, large email receivers are not planning to blindly receive email over IPv6 the way they do with IPv4. Doing so would be swallowing a cyanide pill. It’s crazy! Maybe something like a central whitelist will be created wherein if you want to send mail over IPv6, you have to be registered on that list to do it. This is the model of “block the world and punch holes for your friends” but it’s more or less the same thing that Spamhaus’s PBL does.

How many legitimate email services are there today? 10 million? 20 million? There’s more people in the world, but not everyone needs their own email server. And that’s the point—the problem is manageable if we all agree to not accept mail from anonymous sources on the Internet.

Given how all mail receivers have skin in the game, and given that we worked together with DMARC, the future’s not as bleak as we think.

By Terry Zink, Program Manager

Filed Under


Comment Title:

  Notify me of follow-up comments

We encourage you to post comments and engage in discussions that advance this post through relevant opinion, anecdotes, links and data. If you see a comment that you believe is irrelevant or inappropriate, you can report it using the link at the end of each comment. Views expressed in the comments do not represent those of CircleID. For more information on our comment policy, see Codes of Conduct.

CircleID Newsletter The Weekly Wrap

More and more professionals are choosing to publish critical posts on CircleID from all corners of the Internet industry. If you find it hard to keep up daily, consider subscribing to our weekly digest. We will provide you a convenient summary report once a week sent directly to your inbox. It's a quick and easy read.

I make a point of reading CircleID. There is no getting around the utility of knowing what thoughtful people are thinking and saying about our industry.

Co-designer of the TCP/IP Protocols & the Architecture of the Internet




Sponsored byVerisign

Brand Protection

Sponsored byCSC

IPv4 Markets

Sponsored byIPv4.Global

Domain Names

Sponsored byVerisign

Threat Intelligence

Sponsored byWhoisXML API

New TLDs

Sponsored byRadix


Sponsored byDNIB.com