Re: smtp time spam filtering
David Hart wrote:
> On Sat 2007-02-24 21:03:11 -0500 Greg Folkert wrote:
>> On Sat, 2007-02-24 at 23:24 +0100, Matus UHLAR - fantomas wrote:
>> > > > On Fri, Feb 23, 2007 at 03:33:00PM +0000, David Hart wrote:
>> > > > > I must be missing something here. In order to scan an email you
>> > > > > must
>> > > > > receive the email (I don't mean accept). How can
>> > > > > rejecting/accepting emails at this stage make any significant
>> > > > > difference in bandwith used (let alone a quadrupling of
>> > > > > bandwidth)?
>> >
>> > > On Fri 2007-02-23 08:16:48 -0800 Andrew Sackville-West wrote:
>> > > > isn't it just using RBL's at smtp time and rejecting before
>> > > > recieving the mail?
>> >
>> > On 23.02.07 19:15, David Hart wrote:
>> > > AFAIU no, but that's the way I do it with postfix. Both my primary
>> > > and secondary MXs do RBL checks and stuff like recipient validation
>> > > and then make the accept/reject decision after the RCPT TO: but
>> > > before the DATA.
>> > >
>> > > Greg Folkert said that he uses SA-Exim (which calls spamassassin)
>> > > to do scans at smtp time but without any online checks. I don't see
>> > > how you can do this without receiving the bulk of the email.
>> >
>> > the advantage of smtp time rejection is, you will just reject the data
>> > with error and you don't have to do anything with it - the rest is up
>> > to sender. Especially if you would bounce the e-mail, you'll win this
>> > way...
>>
>> Bouncing... bingo. If the sender doesn't handle it properly, it isn't my
>> problem.
>
> You've already outlined a case where bouncing spam became your problem.
> You said in an earlier mail "I used to not whitelist murphy, but that
> got me auto-unsub'd from (most) Debian lists I subscribe to, for
> "bouncing" the SPAM"
4xx rejects work better than 5xx for content-related rejects: After all
there is a chance the message would be accepted under better circumstances
in such a case. Or read the list via
nntp://news.gmane.org/gmane.linux.debian.user instead. :o)
Reply to: