SMTP AUTH?

[Richard Kettlewell <]

John Martin writes:
> In particular, I was thinking of a much simpler, albeit more drastic
> anti-spam test:
> 
> 		C: connect to server
> 		S: check if client in "allowed" list
> 			/		\
> 
> S: 421 Service not available		S: 220 pleased to meet you
> S: connect to client			 <normal SMTP transaction>
> S: check if client allows relaying
> S: add client (or not) to "allowed"
>    or "forbidden" list
> 
>    ...some time later, client re-tries
> 
> C: connect to server
> S: check if client in "allowed" list
> S: 220 pleased to meet you
>    <normal SMTP transaction>
> 
> The test can be applied positively or negatively (i.e. an "allowed"
> list or a "forbidden" list). I'm not sure if 421 is the right code
> to use and I realise that this would mean a drastic reduction in the
> number of legitimate mail received also - since relatively few
> people implement anti-relaying but... does this scale? (probably
> not)

It doesn't scale.  Suppose you have two hosts running this code trying
to talk to each other.  The first one sends a 421 response (or just
blocks, for that matter) and contacts the second - which itself sends
a 421 response (or just blocks) and contacts the first - and the loop
starts over again.

As you notice, it will also reject legitimate mail from hosts which
happen to permit relaying.

A friend of mine is currently testing some software which uses bait
addresses to generate a blacklist and reject spam on that basis - the
idea being that you widely publish the blacklist address so that it
gets onto spammer's mailing lists, and then whenever you get mail to a
recipient list that includes a bait address you know it's spam and can
be rejected.  I'll post a reference to it here when he's a bit further
on with the project.

ttfn/rjk