17.11.2010 17:45, Wietse Venema wrote: [] > In the "before 220 greeting" phase, the time consuming test is > PREGREET, and postscreen could save time if the DNSBL test says > that a client is malicious. This however requires that postscreen > evaluates the DNSBL result as soon as it is available. Currently, > postscreen evaluates the DNSBL result after the PREGREET test > completes (read timeout, or the client spoke too soon), and the > patch did not change that if I recall correctly :-).
This is something that better be left as is for now, I think. How much does it really cost to enforce this pause? If it's cheap enough, lets keep it, in a hope to slow the bad guys... ;) Seriously, when I experimented with my huge number of connections from zombie machines, I've seen direct impact on other mailservers when I stopped/resumed my "screener". My tiny machine was keeping ~80K connections "busy" waiting for nothing, and on other machines were were significant increase in zombied connections when it weren't working. Yes, at that time spammers weren't prepared for this, so it were effective. But remember, it was a single 200MHz i686 machine... /mjt
