We do exactly this at our Postfix gateways, it's called greylisting. See http://isg.ee.ethz.ch/tools/postgrey/. You may want to consider setting up a gateway in front of your IMail server that supports greylisting.
Bill -----Original Message----- From: Mike Nice [mailto:[EMAIL PROTECTED] Sent: Friday, October 14, 2005 12:43 PM To: [email protected] Subject: Re: [sniffer] Large amounts of spam still getting through > getting much better at what they do. When a spammer uses Geocities > links, hijacks real accounts on major providers to send spam through, > and changes their techniques every few hours, it makes it difficult > for Sniffer to proactively block them, and the delay between rulebase > updates means a delay in catching things that have been tagged. This brings to mind a technique with optional adaptive delay - enabled by the user. Each mail is assigned a 'triplicate': (To_Email, From_Email, and domain_of_sending_server). Previously unknown triplicates are held for a period of time before being examined for spam. The delay is long enough that SpamCop, Sniffer, and InvURIBL mailtraps see copies of the spam and update the blacklists. This would be hard to do with the stock IMail, but possibly could be done by Declude with the V3 architecture and a database. It still doesn't provide a good answer to the problem of spammers hijacking a computer and sending spam through legitimate servers. This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html ------------------------------------------------------------------------------- This message and any included attachments are from Siemens Medical Solutions USA, Inc. and are intended only for the addressee(s). The information contained herein may include trade secrets or privileged or otherwise confidential information. Unauthorized review, forwarding, printing, copying, distributing, or using such information is strictly prohibited and may be unlawful. If you received this message in error, or have reason to believe you are not authorized to receive it, please promptly delete this message and notify the sender by e-mail with a copy to [EMAIL PROTECTED] Thank you This E-Mail came from the Message Sniffer mailing list. For information and (un)subscription instructions go to http://www.sortmonster.com/MessageSniffer/Help/Help.html
