[Mimedefang] Re: Filtering idea for stock pump&dumps

[David F. Skoll]

Kevin A. McGrail wrote:

> Making things more interesting, under the RFC 2821, I think you can read
> that Microsoft is NOT outside the RFC in this matter.  Specifically, the
> RFC states:

> "It is difficult to assign a meaning to "transient" when two different
> sites (receiver- and sender-SMTP agents) must agree on the
> interpretation.  Each reply in this category might have a different time
> value, but the SMTP client is encouraged to try again.  "

However, see Section 4.2.5: Reply Codes After DATA and the Subsequent
<CRLF>.<CRLF>

   When an SMTP server returns a positive completion status (2yz code)
   after the DATA command is completed with <CRLF>.<CRLF>, it accepts
   responsibility for:

   -  delivering the message (if the recipient mailbox exists), or

   -  if attempts to deliver the message fail due to transient
      conditions, retrying delivery some reasonable number of times at
      intervals as specified in section 4.5.4.

That means that if Exchange replies with a 2xx code after DATA, it
accepts responsibility for "retrying delivery some reasonable number
of times at intervals as specified in section 4.5.4." in the face of
transient conditions.  That means that you can't weasel out all that
easily.

(I suppose if the original message is submitted via a non-SMTP protocol,
Microsoft *could* technically wiggle out of this one, but that's really
hair-splitting.)

Regards,

David.