David F. Skoll wrote:
You also penalize mail from "<>" to an invalid address, because that
is a fairly clear indication of spamming.
As a FYI, this isn't our experience. Mail from "<>" to an "invalid"
address is perhaps even more often a postmaster bounce to a spam forged
in our domain.
Of the 225048 connects to our spamtrap so far today, 1747 (~ 1%) of them
are bounces of spam forged in our spamtrap's domain (detected by
checking for both a null return address and "postmaster" or "daemon"
(from mailer-daemon in the body From)). It varies a lot day-by day. For
two days in a row this week it was in excess of 20%.
The idea has some merit, but it'll need more tuning than meets the eye
first glance.
_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg