On Fri, 2007-09-07 at 09:27 -0700, Marc Perkel wrote: > Just wondering something. I'm using the new NOTQUIT acl and looking at
> connections that don't use quit. I'm wondering if the failure to quit
> might be used as a spam indicator. Not as an absolute indicator, but
> just in general. Just thinking out loud here. Always looking for a spam
> indicator.
I know I quoted it in jest, but the message about the sheep recently was
a real one.
There are myriad reasons why some remote server goes away before QUIT -
bad application writing by a spammer, network congestion, intermediate
packet loss, phase of the moon, cosmic particles, birds on the wires...
to name but a few.
Only one of the above is related to spam.
You *cannot* assume that a failure to send QUIT means a given session
has transmitted spam, you really can't. You can't even use it as an
indicator that it might have done.
As an example, I recently received the same message 16 times from
another well-known OSS project mailing list; for some reason the remote
mailer didn't think I had accepted the message when in fact I had, and
eventually it dropped the session without QUIT. OK, so I received the
same message 16 times - that's irritating, but it didn't mean spam.
