North American Network Operators Group
Date Prev | Date Next | Date Index | Thread Index | Author Index | Historical

Re: fingerprinting and spam ID

  • From: Petri Helenius
  • Date: Sat Aug 12 04:14:48 2006

Ken Simpson wrote:
The problem is that I already see enough legit mail hit the
quarantine due to being HTML/multipart, suspected of being sent
"direct-to-MX" due to Exchange's bizarre habit of not providing an
audit trail via Received headers, etc.

Of course by the time you can inspect the body of a message, it's
already sucked down a large chunk of your resources. Host type is
useful in pre-filtering even before you go so far as to send the
banner -- to get rid of or at least slow down the crap that you almost
certainly know is on its way.

The most precious resource for email is in most cases the time spent by reading it. For spam this might not be too many seconds but it still bothers the recipient unneccessarily.

Pete