Wietse, thanks for reply. > Tomoyuki Murakami: >> I'm currently making a trial of postscreen DROP action. >> DROP action is useful for reducing cost of tests, especially >> skipping DNSBL checks are meaningful. >> OTOH, we sometimes need SMTP envelope info to make statistics >> later. the DROP action may also drops the chance of collecting >> these info. > > The ENFORCE action was implemented for exactly this purpose. > > What is the benefit of skipping the other checks?
Main purpose here I have is logging even if the client IP should be blocked (for the policy, etc.). In addition, SMTP envelopes are also needed to statistical analysis of client behaviors. I have plenty of BLACKLISTed IP and checking BLACKLIST is sufficient about them. Other test for them are redundant at this point. especially DNSBL tests. One of the benefits is querying 10Meg. x DNSBL(2 or 3) / day (typical rejection rate in our environment) will be saved. (... yes, not yet do this -postscreen- in real environment :-) > 2) You can avoid a lot of source code changes by putting the new > code inside the DROP_SESSION macro. I did't notice that. thanks for suggestion. > 3) Postscreeen never resets TODO flags, and I'm sure that there is > code that depends on this invariant. To disable tests that are > already in progress, postscreen uses SKIP flags. I think that the "disable test" can be a good news. I'm looking forward to. Many thanks, --- Tomo.
pgpN6XcMPIJg6.pgp
Description: PGP signature
