Re: [Asrg] Re: SPF abused by spammers

[Seth Breidbart <sethb at panix.com>]

"Peter J. Holzer" <hjp-asrg at hjp.at> wrote, in quoted-unreadable:
> On 2004-09-13 17:14:37 +0200, Markus Stumpf wrote:
>> On Fri, Sep 10, 2004 at 07:44:11PM -0400, Seth Breidbart wrote:
>> > The idea is that the spamtrap addresses will cause blacklisting before
>> > the domain can green off the greylist.
>>=20
>> At which point do greylist implementations make the entry for a triple?
>>=20
>> How about a
>>    MAIL FROM
>>    RCPT TO
>>    RCPT TO
>>    RCPT TO
>>    RCPT TO
>>    RCPT TO
>>    [ ... ]
>>    RSET
>> and come back 30 minutes later.
>
> Such a pattern could be a reason to blacklist the sender, too.=20

If the response to the RCPT TOs was 251, then perhaps blacklist (why
would a sender do that, anyway?).  If they were all 451, then RSET is
a reasonable response (nobody wants the message, why continue?) and 30
minutes is a reasonable retry period.

Seth

_______________________________________________
Asrg mailing list
Asrg at ietf.org
https://www1.ietf.org/mailman/listinfo/asrg