Re: [exim] UCEPROTECT Blacklists and why callouts are abusiv…

Top Page
Delete this message
Reply to this message
Author: Andrew - Supernews
Date:  
To: exim users
Subject: Re: [exim] UCEPROTECT Blacklists and why callouts are abusive
>>>>> "David" == David Saez Padros <david@???> writes:

>> You trimmed out the words "in the best case". i.e. the minimum
>> value seen recently is 10%, the average (mean) over a period of a
>> couple of years is 90-95%, and the maximum is 99.99%.


David> well, i had to say that we reject more than 99.99% of the
David> connections received

If you get any real mail at all, then that is nonsense - you'd have to
be getting, say, a half-million connects/day and less than 50 real
emails per day, and you'll have had more than that many just from
today's traffic on exim-users.

That 99.99% peak figure was reached here during a period of a few
hours during which we received more than _10 million_ connection
attempts caused by blowback of all forms, at a domain used only by a
handful of staff which normally gets a few thousand per day.

David> but this does not mean that all of them are callouts.

As I keep saying, if you're rejecting them at RCPT time, callouts,
bounce blowback and C/R are not distinguishable.

David> How many of this 90-95% of blowback uses a null sender
David> envelope ??

Those are connections meeting the following criteria:

1) they got as far as RCPT TO
2) they had a null sender envelope, or one recognisably generated by a
C/R or callout system
3) they were not in response to real mail

Almost all had null senders.

David> what do you mean by C/R ?

Challenge/Response.

--
Andrew, Supernews
http://www.supernews.com