[Raw Msg Headers][Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Spam submission rating

On Thu, 2002-09-05 at 13:21, Matti Aarnio wrote:
> On Thu, Sep 05, 2002 at 11:48:19AM +0400, Eugene Crosser wrote:
> > On Wed, 2002-09-04 at 23:08, Mariano Absatz wrote:
> > > > Speaking of which, we are currently planning to deploy a thing that
> > > > would collect "RCPT TO" rate by peer's IP address in realtime and
> > > > degrade the service accordingly (a la "tarpit").  Anyone already done
> > > > that with Zmailer?
> > >
> > > Nope... but are definitively interested in it... hoy do you plan to keep 
> > > the rate info?  in-core? in a database? collecting info in a log and
> > > parsing it every xxx seconds?
>   What about busy email lists outside your own area with a plenty
>   of subscribers in your system(s) / serviced by your ISP relay ?
>   What about there being a network break, and such a list not being
>   delievered to you in a day, and after service restoration, all
>   of the accumulated backlog hits you ?
>   I have seen these things mis-applied so much that I am extremely
>   wary to implement and deploy any such a thing...
>   The slow-down tarpit is less harmfull to legitimate feeds (if
>   monitored properly!), than yielding 500-series responses, of course.

We thought about that.  The same sentiment applies to big mail relays:
they may produce high traffic which is still legitimate.  We are
planning to have a dynamically modifiable "whitelist" where you will be
able to specify non-default "rating allowance" for ranges of IP
addresses.  And of course it will be necessary to constantly monitor the
status of rating cache.

Another interesting point (for us) is handling dialup customers.  We are
planning to attach the rating value to the customer rather than IP
address if that address belongs to a dialup pool.


To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi