OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
Re: Size availability at MAIL FROM state

From: Miguel Filho (miguel.filhogmail.com)
Date: Mon May 12 2008 - 14:43:05 CDT


On Mon, May 12, 2008 at 2:44 PM, Victor Duchovni
<Victor.Duchovnimorganstanley.com> wrote:
>
> SIZE is widely implemented, and most legitimate mail servers will send a
> reasonably accurate SIZE at MAIL FROM. You can't trust this SIZE value,
> but you can expect it to be more often correct than not.

I'm seriously considering the protocol used by a client as an
indicator of a spam. I'm trying to be more selective when greylisting,
so if a client is using ESMTP and is not listed on a blacklist there
is a good chance that the message is legit.

I randomly looked at some spam messages of gmail account and all of
them were delivered using SMTP e not ESMTP.

Miguel