OK - here's an idea I'm rolling around in my brain and thinking this could work to massively automatically generate white lists of IP addresses from companies that generate no spam at all. This could be used not only to greatly reduce false positives, but also you reduce system load. Any IP listed is ham and no need for further testing.
One thing that spammers can't spoof is RDNS. So if the RNDS of an IP is xxx.xxx.amd.com then we know the email is ham. Suppose that we start with a list of companies that we know that any email that comes from those hosts will always be ham then we can create a dynamically generated whitelist based on host IP addresses that come from the list. A query comes in to a specially written DNS server where the RNDS is looked up and it's xxx.ibm.com and ibm.com is in the list of blessed ham hosts. We would need a fast way of getting rid of the subhost part to do the lookup, stripping the xxx part off to get the domain, . We would then return a yes response and cache the data in a local database. The database could contain tens of thousands of domains that never send spam. How would we get this list? For now I'm doing it manually but it could possible be done by tracking ham and spam hist over time of verious IP addresses and looking for patterns of behavior that would indicate that indicate that the source is 100% clean. Of course this wouldn't solve domains like yahoo, hotmail, comcast, and other mixed source spam but it would allow a lot of email to be preclassified as ham without further testing. Who likes this idea? -- ## List details at http://www.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://www.exim.org/eximwiki/
