Graeme Fowler wrote:
> On Fri, 2007-09-07 at 09:27 -0700, Marc Perkel wrote:
>> Just wondering something. I'm using the new NOTQUIT acl and looking at
>> connections that don't use quit. I'm wondering if the failure to quit
>> might be used as a spam indicator. Not as an absolute indicator, but
>> just in general. Just thinking out loud here. Always looking for a spam
>> indicator.
>
> I know I quoted it in jest, but the message about the sheep recently was
> a real one.
>
> There are myriad reasons why some remote server goes away before QUIT -
> bad application writing by a spammer, network congestion, intermediate
> packet loss, phase of the moon, cosmic particles, birds on the wires...
> to name but a few.
>
> Only one of the above is related to spam.
>
> You *cannot* assume that a failure to send QUIT means a given session
> has transmitted spam, you really can't. You can't even use it as an
> indicator that it might have done.
>
> As an example, I recently received the same message 16 times from
> another well-known OSS project mailing list; for some reason the remote
> mailer didn't think I had accepted the message when in fact I had, and
> eventually it dropped the session without QUIT. OK, so I received the
> same message 16 times - that's irritating, but it didn't mean spam.
I use the lack of a QUIT as an indicator to change my behaviour the next
time that host connects. My greylist causes a defer in the pre-data ACL
if they are a suspect host and if they drop the connection from there,
the next time they connect I defer at RCPT time instead.
Hosts don't get labeled as spam sources just for the lack of a QUIT
though .. too many reasons for it to happen.
--
The Exim Manual
http://www.exim.org/docs.html
http://www.exim.org/exim-html-current/doc/html/spec_html/index.html
