[SPAM-TAG] Re: [SURBL-Discuss] Another to whitelist

Jose Marcio Martins da Cruz Jose-Marcio.Martins at ensmp.fr
Thu May 27 12:02:06 CEST 2004


Jeff Chan wrote:
> On Wednesday, May 26, 2004, 3:16:45 PM, hans hans wrote:
> 
>>On Wed, 26 May 2004, Jeff Chan wrote:
> 
> 
>>>Anyone else seeing any others to whitelist?
>>
> 
>>We might have some when all the spamikaze users are tied together but I
>>might come back on this in a later stage.
> 
> 
> Bitte.  (Please.)
> 
> 
>>Another point or remark. At the surbl site it is mentioned that sendmail
>>isn't aware of bodies. This isn't true for part of your conclusion. It is
>>possible to check the body in sendmail but the problem is dat you will
>>have to fetch the data block to do it. Then again, not getting spam in the
>>users INBOX might also help.
> 
> 
> Yes, milters can be used with sendmail to block on message
> bodies, but as you note it requires letting the data through.
> On the other hand regular RBLs can be used by the MTA to reject a
> lot of connections directly based only on headers.  After passing
> RBLs the bodies need to be checked, and doing that with an MTA
> milter probably uses fewer resources than doing it in
> SpamAssassin, for example.
> 
> 
>>A little file to help understand the above:
> 
> 
>>http://spamikaze.is-a-geek.org/sendmail-subjectblocking.txt
> 
> 
>>Reading the SubjMatchReject file will produce a 550.

Not really...

SMTP protocol is based on a series of commands.

- EHLO
- MAIL FROM
- RCPT TO
- DATA

Message body and ALL headers are inside DATA command. So, if you've 
decided to block the message, based on the Subject Header content, the 
MTA needs to receive ALL the message body, before sending the 550 answer 
to the smtp client. Even if it seems to you you've already said to the 
MTA that it shall reject the message. This isn't particular to sendmail, 
but defined at RFCs.

> 
> 
>>The good thing about it is that you will not block the ipnumber like the
>>surbl goal is stated on the site. The bad thing is that spamming sites
>>will keep pumping data to the mta.
> 
> 
> Blocking on subjects is definitely interesting, but bodies
> are where the spam sites typically are.
> 
> Jeff C.
> 
> _______________________________________________
> Discuss mailing list
> Discuss at lists.surbl.org
> http://lists.surbl.org/mailman/listinfo/discuss
> 
> 



-- 
  ---------------------------------------------------------------
  Jose Marcio MARTINS DA CRUZ           Tel. :(33) 01.40.51.93.41
  Ecole des Mines de Paris              http://j-chkmail.ensmp.fr
  60, bd Saint Michel                http://www.ensmp.fr/~martins
  75272 - PARIS CEDEX 06      mailto:Jose-Marcio.Martins at ensmp.fr



More information about the Discuss mailing list