Re: Why SRS really sucks

On Wed, 26 Apr 2006, Hannah Schroeter wrote:

> >In this case, you have almost no chance to give the error right after MAIL 
> >FROM. You must be able to know, which user this mail will be adressed to to 
> >determine which settings apply. Regarding the RFC, afaik this won't let you 
> >any option other than receiving the DATA.
> >Or did I get you wrong here?
> 
> You did get something wrong: You know the recipient after RCPT TO, so at
> *that* point you can lookup the user's settings and apply
> recipient-specific policy to perhaps deny the mail. No need to wait for
> the DATA command or even the completion of the DATA phase.

However, REJECTING a RCPT only rejects that recipient.  The SMTP protocol
requires you to keep accepting RCPT commands until the DATA command.
Only after the DATA command can you reject the entire message.

Spammers take advantage of this to test hundreds of RCPTs on a
single MAIL FROM.  The best you can do is throttle the rate at which
you answer the RCPT commands. (Of course you could always hang up on an abusive
MTA - but that would be a protocol violation, and is usually counter productive
unless coupled with an IP blacklist.)

-- 
	      Stuart D. Gathman <[email protected]>
    Business Management Systems Inc.  Phone: 703 591-0911 Fax: 703 591-6154
"Confutatis maledictis, flammis acribus addictis" - background song for
a Microsoft sponsored "Where do you want to go from here?" commercial.