Peter J. Holzer wrote:
On 2011-10-28 14:17:56 -0700, Steve Atkins wrote:
A somewhat simpler strategy could be to always apply the delay to the
message.
That is what we do at the DATA level and once a 451 greylist is
issued, no further transactions are allowed. In fact, we our small 55
secs, I had found some spammers will hold the connection and try
again, thus finding a loophole. I have working evidence of this
closing this loophole. See the "451 Transactions disabled due to
policy" response below:
**************************************************************************
Wildcat! ESMTP Server v6.4.454.1
SMTP log started at Fri, 28 Oct 2011 12:07:31
Connection Time: 20111028 12:07:31 cid: 000069F9 tid: 00000A64
SSL-Enabled=NO No-Quit-Cancel=OFF Receiver-Bin=ON
Client IP: 76.73.19.178:64948 (unknown) Host IP: 208.247.131.9:25
12:07:31.612 S: 220 winserver.com Wildcat! ESMTP Server v6.4.454.1 ready
12:07:32.408 C: EHLO host.germdefenderproducts.com
12:07:32.408 S: 250-winserver.com, Pleased to meet you.
12:07:32.408 S: 250-SIZE 10240000
12:07:32.408 S: 250-8BITMIME
12:07:32.408 S: 250-SUBMITTER
12:07:32.408 S: 250-ETRN
12:07:32.408 S: 250-AUTH CRAM-MD5 LOGIN PLAIN PLAIN-MD5 SHA-1
12:07:32.408 S: 250-AUTH=LOGIN
12:07:32.408 S: 250 HELP
12:07:34.280 C: MAIL FROM:<Sonya(_at_)germdefenderproducts(_dot_)com>
12:07:34.280 S: 250 <Sonya(_at_)germdefenderproducts(_dot_)com>... Sender
validation pending. Continue.
12:07:35.153 C: RCPT TO:<hector(_at_)santronics(_dot_)com>
12:07:35.497 ** WCX Process: wcsap ret: -1 (344 msecs)
12:07:35.497 S: 250 <hector(_at_)santronics(_dot_)com>... Recipient ok
12:07:36.323 C: DATA
12:07:36.323 S: 354 Start mail input; end with <CRLF>.<CRLF>
12:07:38.913 ** end of data received. (bytes: 10103) (3.6 K/s)
12:07:39.007 ** WCX Process: SmtpFilterHookLoader ret: 0 (94 msecs)
12:07:39.007 S: 451 Greylisted. Please try again later (TempFail)
retry=00:00:55
12:07:39.849 C: RSET
12:07:39.849 S: 250 Reset State #1
12:07:40.613 C: MAIL FROM:<Suzanne(_at_)germdefenderproducts(_dot_)com>
12:07:40.613 S: 451 Transactions disabled due to policy.
12:07:41.378 C: RSET
12:07:41.378 S: 250 Reset State #2
12:07:42.142 ** connection drop - error: 10054 state: tDefault
lastcmd: RSET
12:07:42.142 ** Completed. Elapsed Time: 10530 msecs
But I also believe there is Connection Sharing/Holding clients as many
will hold and then try to start a new transactions. Maybe it would be
nice to suggest to the client to hangup but we right now instead I'm
exploring the 5 mins IDLE time drop to 1 minute after the first
transaction attempt.
--
Sincerely
Hector Santos
http://www.santronics.com
jabber: hector(_at_)jabber(_dot_)isdg(_dot_)net