Re: A potential way to cut down on spam.

[acli@ada.dhs.org]

In article <4020F71F.5030606@iplink.net>, alvin
<alvin@iplink.net> wrote:

>His idea is to report a temproary failure on the first time
>a new server connects to send mail to a given user. The idea
>being that a spammer will drop the message and just go on to
>the next victim but a real mailer will try again in a couple
>of minutes. Then once this connection:user pair is blessed the
>rest of the messages can be taken without any further waiting.

This might work to some extent, but likely not as well as
expected because the assumption is not on solid ground.

Some spammers use a strange tactic that if they encounter a
failure (even 5xx ones), they will change the HELO name and hope
that we simply blocked one HELO name. They even do this quickly
in succession for a large number of times. Fortunately this
seems rare.

The other is that if the spam do not come directly from the
spammer (e.g., if the mail went through a .forward or similar,
or sent through an insecure real mailer, etc.), the other side
(likely a real mailer) will continue retrying anyway. (For me,
most of the spams blocked at home with a 4xx fall into this
category.)

-- 
Ambrose LI Cheuk-Wing  <a.c.li@ieee.org>

http://ada.dhs.org/~acli/
-
To unsubscribe from this list: send the line "unsubscribe zmailer" in
the body of a message to majordomo@nic.funet.fi