[LINK] Solution to SPAM checking

[Craig Sanders]

On Thu, Feb 01, 2007 at 09:15:02AM +0800, Adrian Chadd wrote:
> Actually, I've seen spam levels drop after turning on this kind of verification
> but not because of the received spam levels. It dropped because:
> [...]
> So it has a positive effect, if setup carefully.
> 
> > it's also completely useless on very busy mail servers because they're
> > already struggling under the load of receiving and delivering actual
> > mail, let alone making an extra outbound SMTP connection for every
> > incoming message (even caching the result of the Sender address lookup
> > doesn't help much). so, it's vaguely useful on small, lightly-loaded
> > mail servers. which hardly makes a dent (if at all) on the spam volume.
> 
> It dropped the server load of the central AV/spam scanning gateway at my
> last job. Which was pushing > couple million messages a day easy.
> The server suddenly didn't have to handle huge amounts of bounce load.

greylisting would have the same effect (of reducing AV/spam scanning
workload), without the workload of extra outbound smtp connections.

that workload is irrelevant on a small server, but significant on a
large server - and that's just the workload on the receiving server
(i.e. the one attempting to verify the sender address)....you also
need to consider the extra workload that sender verification causes
to already heavily-loaded services like hotmail, yahoo (esp. yahoo
groups where their use of VERP-style bounce addresses means caching of
sender-address verification results is futile), gmail, etc.


but my point wasn't that sender-verification was completely useless,
just that it wasn't the miracle cure that a particular idiot wanted to
think it was.

btw, most SMTP servers have VRFY or EXPN disabled (and have done so for
years as for privacy/anti-dictionary-attack reasons), so the only way to
test for validity of an address is to attempt to actually send a message
(i.e. a valid sender address is when you get a "2xx OK" response to a
"RCPT TO:<address>")

craig

-- 
craig sanders <cas at taz.net.au>           (part time cyborg)