[Mimedefang] Blocking Dictionary Attacks

[WBrown at e1b.org]

Les wrote on 06/09/2009 01:59:38 PM:

> And unless you expect messages with a large number of recipients you can
> refuse to accept them without running any perl code:
> define(`confMAX_RCPTS_PER_MESSAGE',`5')dnl
> 'Real' senders are supposed to figure this out and resend but I don't
> know how it works out in practice.

This can cause long delays in processing messages with a lot of recipients.
After the 5 allowed RCPT TO's, the rest are tempfailed.  The sender has to
queue the message again for the remaining recipients and it waits for the
next queue run before trying them.  Lather - rinse - repeat.  For 100
recipients, it will take 19*interval minutes to deliver the message.  Even
if the queue interval is 5 minutes, that's still more than an hour and a
half.