ietf-asrg
[Top] [All Lists]

Re: [Asrg] Re: SPF abused by spammers

2004-09-13 09:59:20
"Peter J. Holzer" <hjp-asrg(_at_)hjp(_dot_)at> wrote, in quoted-unreadable:
On 2004-09-13 17:14:37 +0200, Markus Stumpf wrote:
On Fri, Sep 10, 2004 at 07:44:11PM -0400, Seth Breidbart wrote:
The idea is that the spamtrap addresses will cause blacklisting before
the domain can green off the greylist.
=20
At which point do greylist implementations make the entry for a triple?
=20
How about a
   MAIL FROM
   RCPT TO
   RCPT TO
   RCPT TO
   RCPT TO
   RCPT TO
   [ ... ]
   RSET
and come back 30 minutes later.

Such a pattern could be a reason to blacklist the sender, too.=20

If the response to the RCPT TOs was 251, then perhaps blacklist (why
would a sender do that, anyway?).  If they were all 451, then RSET is
a reasonable response (nobody wants the message, why continue?) and 30
minutes is a reasonable retry period.

Seth

_______________________________________________
Asrg mailing list
Asrg(_at_)ietf(_dot_)org
https://www1.ietf.org/mailman/listinfo/asrg