[Mimedefang] Adding support for learning our addresses

[David F. Skoll]

Philip Prindeville wrote:

> Rather than blocking the entire network (CIDR block) automatically, at
> least blacklisting
> the individual address for 3-5 days?

If I did that, I'd end up blocking Hotmail and MSN's servers more-or-less
permanently.  While I might not think that's a Bad Thing, it's probably
not acceptable for most MIMEDefang users.

Unfortunately, the mapping between spammer and IP address is rather
tenuous, from the extreme of many spammers per IP address (Hotmail) to
many IP addresses per spammer (your average zombie spam-run.)

What I do on my server is ban an IP address for an hour if I detect
a dictionary attack (too many invalid recipients).  That seems to
work pretty well.

Regards,

David.