Can't the whole process be made simpler by changing the tripplet to a couplet?
Instead of watching sourceip, from address, to address can't we just watch sourceip? or sourceip and to address?
If you ignore the from address, what would ever qualify a server as "known good"? The general idea is that if you see repeated deliveries from one address to another, the server sending the message is probably acting in good faith and should be allowed to communicate.
My impressions are that the implementation is too complicated, as well. I don't like the idea of tracking the sender's IP, because that will cause more delays than necessary if the sender uses a cluster of MTA's. Also, many MTA's acting in good faith will attempt redelivery in a very short period of time, while *most* spammers won't send messages from the same sender to the same recipient immediately, so the minimum delay just makes legitimate mail take longer than it needs to.
------------------------------------------------------- This sf.net email is sponsored by:ThinkGeek Welcome to geek heaven. http://thinkgeek.com/sf _______________________________________________ courier-users mailing list [EMAIL PROTECTED] Unsubscribe: https://lists.sourceforge.net/lists/listinfo/courier-users
