Re: fingerprinting and spam ID

Ken Simpson wrote:

...

The problem is that I already see enough legit mail hit the quarantine due to being HTML/multipart, suspected of being sent "direct-to-MX" due to Exchange's bizarre habit of not providing an audit trail via Received headers, etc.

Of course by the time you can inspect the body of a message, it's already sucked down a large chunk of your resources. Host type is useful in pre-filtering even before you go so far as to send the banner -- to get rid of or at least slow down the crap that you almost certainly know is on its way.

The most precious resource for email is in most cases the time spent by reading it. For spam this might not be too many seconds but it still bothers the recipient unneccessarily. Pete