Spam filtering bcps [was Re: Open Letter to D-Link about their NTP vandalism]

Wed Apr 12 19:38:53 UTC 2006

On Wed, Apr 12, 2006 at 12:03:51PM -0400, Joe Maimon wrote:
> Matthew Black wrote:
> 
> > there's no bandwidth savings from silently dropping the message
> > versus providing a 550 rejection. In the best of all worlds,
> > it would be nice to give feedback. No system is perfect and a
> > false-positive rate of less than one in a million "220" accepted
> > messages seems pretty small.
> 
> Let me ask you this simple question:
> 
> If you know at close of DATA whether you are going to actually perform 
> final delivery, what does it cost you to follow standards and issue a 
> 550 instead of a 220 and discard it?
> 
> If you use a 550, a real live person sending an email that somehow gets 
> FP will actually benefit.

In today's world, at least with the spamtorrent I see at my clients,
that's just untrue.  If your filtering is set up well, and you mark
an e-mail as SPAM, it almost certainly is (yes, I'll certainly concede
FP's exist, but again, it almost certainly doesn't matter that much in
that teensy number of occurrences); and 99-plus-percent of spam
is emitted from spambots who don't give a $expletive about return
status one way or another.  If you're worrying about "no-status" in
the context of FP's, then your filtering isn't set up well, which really
means you've got larger problems.

> I am with Suresh on this, just like in the past threads. Search the archive.

Though not contradicting what I just wrote, so am I.  However, header-forged
and multi-chained spam from firehose-like spambots don't play by any of our
rules; all they do is blast away in a largely one-way transaction (guess
which direction!).  A 550 now-a-days has nowhere to "go" (and those
"commercial" akak "legit") spamhouses don't wash their lists even on 550's.

-- 
Henry Yen                                       Aegis Information Systems, Inc.
Senior Systems Programmer                       Hicksville, New York