OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Postfix Archives: Re: 4xx vs 5xx for spam rejects

Re: 4xx vs 5xx for spam rejects

Subject: Re: 4xx vs 5xx for spam rejects
From: Wietse Venema (wietseporcupine.org)
Date: Mon Dec 20 1999 - 07:55:28 CST

ibrahim khalifa:
> On Mon, 20 Dec 1999, Michael Sobolev wrote:
>
> > The quiestion is quite simple. Are there any recommendations on when to use
> > 5xx codes for spam? I have a problem here. Few hosts are trying to deliver
> > spam messages (I do know this is spam) after receiving 4xx code. I would
> > easily tolerate that, but they are trying to deliver the messages every minute
> > and I am not sure whether they have time limit of any kind: one of the hosts
> > tried to deliver the message for 10 days (until, I just ipchained it away!).
>
> 4yz = Something went wrong, but try again later it might work then.
> 5yz = Something went wrong, don't try again later, it will probably not
> work then either.
>
> So you are telling them to try again later, and they do as you say, what's
> the problem?

Some systems retry within a minute, and that is excessive.

I've decided to use 5xx codes for all "does not exist" DNS replies
for sender address lookups. However I review the reject logs daily.

On the other hand, I've found that insisting on DNS confirmation
for client hostname and HELO parameters loses too much of my mail.

Watching the log and dropping packets from bad hosts is a good
plan. It slows the spammer down (provided you drop their packets
silently) and is better than wasting a Postfix socket.

        Wietse Wietse

This archive was generated by hypermail 2b27 : Mon Dec 20 1999 - 08:00:24 CST