Steven: Thanks for the clarification. I was under the impression that the milter is called only after the message had been received.
Obviously, in order to do content analysis or other magic on a message, you have to receive the content. As I understand it, what these tools do is allow the SMTP "DATA" verb to be sent, and to receive some or all of the data from the sender. Then, before the SMTP result code 250 ("Message accepted for delivery") code is sent, the filter runs and makes a decision. If the message fails, an SMTP error status code is sent instead.
This is fine as long as your mail volume is reasonably low. As mail volumes increase, however, it becomes impractical to do this all in "real time" on your MX.
That's why I have mixed feelings about sites that do unilateral blocking based on blacklists. Many of these systems find 75% of their mail volume is bogus (spam, worms, phishing, and backscatter). They get faced with the proposition of lowering the load on their systems by 90% at the cost of 5% of their legitimate mail. If you're an ISP trying to get by on paper thin margins, that might be considered "acceptable losses". Of course, that's cold comfort to those who (like me) *are* the acceptable losses. :(
Spam sucks.
-- Ben <[EMAIL PROTECTED]> _______________________________________________ gnhlug-discuss mailing list gnhlug-discuss@mail.gnhlug.org http://mail.gnhlug.org/mailman/listinfo/gnhlug-discuss
