Silent Spam Rejection (or at least cache rejection)
Posted: Sun Jan 16, 2011 3:27 pm
Hello:
After using the feature IP BLACK LIST under MagicSpam Exception Lists, we have noticed an major increase of emails coming from a couple of specific IPs listed on the Black List.
Ether they're trying to overload the SMTP service just because they are being rejected, or they simply are trying to find out what email address really exists (confirming they exists when MagicSpam rejects the message) while if an address doesn't exists, its the MailServer who sends a response saying MAILBOX NOT FOUND.
Could any of these 2 options below be added in order to avoid this kind of behavior?
. Silent Rejection. Could be that they get no response at all from the server (I understand MagicSpam doesn't send any email when blocks an email/IP. The rejection message is generated by the Postmaster's sender MailServer). If no response is given, the Postmaster of the sender's MailServer will generate a message saying "Sorry I give up, message could not be delivered. Remote server is not responding".
. Or as a second option, simply do a cache rejection. Meaning that if an IP is black listed, and it sends messages to the same address several times a day, they would get the same reply but the SMTP didn't have to stress if its already happened once with the same blocked IP and the same receptor.
I guess this way, known spam sources would stop (or at least reduce) this kind of "attack" if we can call it like that.
I would appreciate an answer on this matter.
Thank you in advance.
After using the feature IP BLACK LIST under MagicSpam Exception Lists, we have noticed an major increase of emails coming from a couple of specific IPs listed on the Black List.
Ether they're trying to overload the SMTP service just because they are being rejected, or they simply are trying to find out what email address really exists (confirming they exists when MagicSpam rejects the message) while if an address doesn't exists, its the MailServer who sends a response saying MAILBOX NOT FOUND.
Could any of these 2 options below be added in order to avoid this kind of behavior?
. Silent Rejection. Could be that they get no response at all from the server (I understand MagicSpam doesn't send any email when blocks an email/IP. The rejection message is generated by the Postmaster's sender MailServer). If no response is given, the Postmaster of the sender's MailServer will generate a message saying "Sorry I give up, message could not be delivered. Remote server is not responding".
. Or as a second option, simply do a cache rejection. Meaning that if an IP is black listed, and it sends messages to the same address several times a day, they would get the same reply but the SMTP didn't have to stress if its already happened once with the same blocked IP and the same receptor.
I guess this way, known spam sources would stop (or at least reduce) this kind of "attack" if we can call it like that.
I would appreciate an answer on this matter.
Thank you in advance.