On Fri, 21 Mar 2003, John Dalbec wrote:
> The documentation mentions that verify=sender/callout is a
> performance hit.
Sure - you've got to do practically all the work of setting up a
fresh mail transaction.
In the short term it may bring a worthwhile benefit, though. [1]
> In Exim 4.14, how much extra load can I expect?
"Pass" on any kind of general answer to that, but ours seems to handle
what we're doing, just fine. But then, ours is only a modest
operation and has capacity in hand.
You certainly should do your other "less-expensive" acceptance tests
(local IP blocking lists, local envelope-sender bans, RBL lookups)
before proceeding to the more-expensive tests like callout.
> Some spammers use randomized addresses so I guess caching won't
> work for them.
Indeed.
And many an MTA will do no more than confirm an address as
syntactically correct, irrespective of whether it really exists,
which makes the callout a waste of time and effort.
I'm inclined to use something like
deny hosts = *
sender_domains = partial-dbm;CONFIG_DIR/callback_domains.db
!verify = sender/callout
and only put into the callback_domains those MTAs which appear
to be frequently forged by spammers _and_ have proven their ability
to refute non-existent addresses.
But YMMV, obviously.
[1] In the long term, of course, if we all did this, then the spammers
would take care to only counterfeit genuine addresses (probably of
innocent third-parties), so in the long term this policy could be
deemed harmful, even if, as seen from our own individual perspective,
it brings a short-term advantage - which indeed I'm sure it does.
BTW, callout can also block mail from envelope senders whose mail
domain never responds. But if the rejectlog seems to be getting
cluttered up with repeated retries like:
2003-03-20 20:05:56 H=spamming.example [1.2.3.4]
F=<spammer@???> temporarily rejected RCPT
<whatever@???>: Sender verify did not complete
then the domain gets added manually into a separate local list,
something like this (not tested in quite this form):
deny message = We are currently unable to accept mail from \
$sender_address_domain\n\
because that mail domain is persistently unreachable or not\n\
responding properly, for reasons that are outside our control.\n\
We do not know if/when the problem will be resolved, but you\n\
could try again in a few days, or if the matter is urgent\n\
then contact postmaster@???
sender_domains = partial-dbm;CONFIG_DIR/unreach_domains.db
If you do that, then I suppose it's incumbent on you to make an
occasional check to see that the problem domain hasn't started
behaving itself again.
good luck
