Currently I use greylisting in filter_begin with 4 minutes block time, it works fine and reduce most of the spams. But there are still few spams slip through with the score between 3 and 6 (my score threshold is 6) . My idea is to reply the sender a temporary failure message if the score is between 3 and 6 and set the block time to an hour, with the hope if the spam come again later in an hour or longer, I will have already more information from rbl,razor,dcc or so. With this selected longer block time, only hard detected spam or new triple for legitimate email that look like spam will be delayed for an hour, but new triples with easy detected legitimate email will have only 4 minutes block time. So the question is if someone else is doing this additional block time for specific score and if it is worth to do it (hard detected spam get more score after an hour?) . and another question is if it is ok to send temporary failure massage in filter_end (I think this is ok, isn't it? I just want to be sure :) )
thanks, cahya. _______________________________________________ Visit http://www.mimedefang.org and http://www.canit.ca MIMEDefang mailing list [EMAIL PROTECTED] http://lists.roaringpenguin.com/mailman/listinfo/mimedefang
