Re: [Exim] IS it possible? An idea may be

On Fri, 9 Aug 2002, Suresh Ramasubramanian wrote:

> djc@??? (Dave C.) [Friday, August 09, 2002 8:30 AM]:
>
> > On Fri, 9 Aug 2002, Suresh Ramasubramanian wrote:
> >> Aye. Now try that on an extremely busy cluster of mailservers with a
> >> userbase of several million mailboxes (or hell, several thousand
> >> mailboxes).
> >
> > Spamcop works pretty well - it is acceptable to allow your users to
> > mail as they will, and only act on actual complaints.
>
> Spamcop? Separate set of rants in store for that one. It is far better
> than crap like "Spamkiller" or "NUCEM" but it does make silly assumptions,
> and does get fooled by forged headers (not too often these days, after I got
> Julian Haight to whitelist my servers...)
>
> That, and I don't see just where spamcop can be used as an outbound mail
> control system. Yup, it can be used by people who get spammed to send
> complaints. But that's kinda like closing the stable door long after the
> horse has bolted.

Yes, it is an after the fact measure. But if your AUP has terms like
'agree to pay up to $100 per message for violations', and if you make it
clear you terminate accounts at the first offense......

> This has to be something in real time. Something like an outbound and/or
> inbound mail control to prevent and stop dictionary attacking users in the
> middle of their spam run. And spammers randomizing domains in RCPT TO won't
> really help once the mail is in the queue ... Exim would sort according to
> host for delivery, right?

Not if the spammer was sending to, say a thousand different domains,
with a hundred addresses in each domain.

If they sent a sperate message, each one one recipient in each domain,
for a total of a thousand recipients, and a hundred messages...

Now, perhaps a maximum number of recipients per message would at least
slow them down...