At 12:38 PM 2/16/2003 -0500, Greg A. Woods wrote:
>[ On Sunday, February 16, 2003 at 21:12:30 (+0530), Suresh Ramasubramanian
>wrote: ]
> > Subject: Re: [Exim] bouncing viruses
> >
> > I have seen that issuing a REJECT or a 5xx to virii is a problem, since at
> > least some of the direct to MX virii have this habit of hammering nonstop
> > at your server at several hundred times a minute (or more) if they get a
> > reject.
>
>Never issue a single-line 5xx reject response without delaying. Ideally
>issue the first line of a multi-line 5xx reject after a short delay and
>only send the last line after a much longer delay.
>
> > Accepting the mail and trashing it is a quite good way to go, in this case.
>
>No, not really, especially not if you're rejecting before the DATA phase.
And just how are you supposed to reject before DATA for virus infected
mail? Is there support for "crystal ball" libraries in exim or something?
Normally yes, if there's one particular envelope sender / other pattern in
MAIL FROM:, we can REJECT that straightaway without all this headache
coming in. However, this thread seems to assume that the mail is accepted
and passed to a virus scanner of some sort.
srs
