Re: SRS comments/questions

On Fri, 2005-07-15 at 22:46 -0500, Damian Menscher wrote:
> Also, I'm curious how this works with greylisting.  Does SRS update the 
> timestamp for each delivery attempt, or only for each message? 

That's implementation-dependent. Mine did it on each attempt, which is
why I had to take the more precise timestamps out of the debugging info
in the domain part of the generated address.

Mine's only really used for BATV/SES, because my 'spf-afflicted-domains'
list has remained basically empty -- but the principle is the same.

>  If it updates for each delivery attempt, that would cause the same
> message to be greylisted twice if it happened to be sent shortly
> before the midnight hour (which might be business hours, if unix_time
> is in GMT and your business is elsewhere). 

That's possible, yes. But relatively unlikely and the 'failure mode' is
only a slightly longer delay than greylisting would normally cause.

>  Even if it only updates the timestamp once, this will still cause
> daily greylisting slowdowns, but I guess that can't be avoided.

Only if the greylister's 'whitelist' is by sender address, which would
be silly. The point about greylisting is that you suspect that the
sending host might be a spambot and not a real mail host. If the _host_
is one that is known to queue and retry, there's really no point in
greylisting mail from it. 

You use the sender and recipient addresses in order to _detect_ the a
given mail is the same as the one you were offered five minutes ago,
purely as an implementation detail -- but when it comes to whitelisting
certain senders which you now think are genuine, it doesn't make much
sense to keep using the sender address -- you might as well do your
whitelist by the IP address of the sending host instead.

Consider these cases...

Firstly... you are offered a mail from [email protected] from a certain
mail host. You greylist, and a few minutes later the same host offers
the same mail again. It's accepted. 

The next day, you are offered a mail from [email protected] from the
_same_ mail host as before. Do you gain anything by greylisting? What
are the odds that you'll just cause a delay to valid mail, vs. the odds
of actually preventing a spambot from injecting its mail?

The next day you are also offered a mail from [email protected] from some
_other_ host. Do you gain anything by greylisting it _this_ time? Again,
what are the odds?

-- 
dwmw2