Subject: Re: [Asrg] Need to know

From: Scott Nelson <[email-masked]>
Date: Tue, 27 May 2003 00:49:41 -0700

At 01:24 AM 5/27/03 +0200, Markus Stumpf wrote:
>On Sat, May 24, 2003 at 11:27:15PM -0700, Scott Nelson wrote:
>> >Why would limiting number of recipients make a difference? With today's 
>> >computers and Internet connections cheap, additional SMTP sessions will be 
>> >initiated just increasing Internet traffic.
>> 
>> That's an interesting theory you've posited.
>> How, I wonder, could we prove it?
>
>qmail only does one recipient delivery.
>Statistics show (haven't an URL ready, sorry) that the overall "overhead"
>against multi-recipient systems is nearly unmeasurable. Of course there ARE
>situations, were it is a big gain to use multi-recipient strategy.
>
>Most of the time recipient sorting on the sender site is rather CPU and
>DNS expensive so in the same time some mailservers spend sorting
>other actually finish the deliveries.
>

I'm guessing, but I think the qmail sorting problem is quite different 
from the spammer sorting problem.  Spammers don't have to sort on the
fly - they can sort their lists well before hand, and the list only 
needs to be sorted once.

Still, if we knew the average number of recipients for spam 
messages currently, and the average number for non-spam,
then we could at least make a reasonable estimate of the effects 
of limiting it, in terms of number of connections, and total bandwidth.  
If it turns out the average number of recipients
is less than 1.1, then clearly limiting it to one wouldn't
have much effect at all.  If it's 50, then that's nearly a
50 to 1 increase in raw network cost.  To fully understand
the ultimate effect we'd still need to know what effect raising
the cost of sending has on spam and non-spam, but "the average
number of recipients" is at least one of the things we "need to know".

It occurs to me that if the SMTP protocol was changed so that it 
didn't /guarantee/ 100 recipients, it could still allow more than
one for trusted senders.  (local policy would dictate of course,
but the I'd make the wording "SHOULD limit to one, unless the 
sender is trusted") Established mailing lists wouldn't be affected
as much, since they would probably be whitelisted relatively 
quickly by the big ISPs.  

Scott Nelson <[email-masked]>
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: Markus Stumpf <[email-masked]>
Date: Tue, 27 May 2003 22:27:05 +0200

> messages currently, and the average number for non-spam,

I used the maillog of one of our mailservers of the last 22 hours.
It saw
    128582	RCPT TO commands in
    110709	connections
the data is cleaned of 5 customers that did newsletter injects today
that consisted of about 100-250 recipients per connection).

Please note that this mailserver is used by our customers as an outgoing
relay and also by external users as a MX host. If you think this will
make the data inaccurate I could try to filter out our customers to
get better figures.

The distribution is
    102252 1	(aka 102252 times 1 recipient per connection)
      4562 2
      1983 3
       674 4
       435 5
       351 6
       132 7
       109 8
       101 10
	52 9
	16 13
	 9 15
	 9 12
	 8 11
	 3 16
	 3 14
	 2 17
	 1 74
	 1 70
	 1 65
	 1 41
	 1 26
	 1 25
	 1 22
	 1 20
If I only use those hosts that weren't
    a) rejected for sender address blocks (spam)
    b) rejected for recipient address blocks (spam)
    c) tagged because listed with DNSBLs
the distribution is
    66269 1
     2781 2
      575 3
      248 4
      125 5
       84 6
       54 7
       54 10
       39 8
       21 9
	4 13
	3 15
	3 12
	3 11
	2 16
	1 22
	1 17
	1 14
The distribution for all "spam" classified emails is:
    35983 1
     1781 2
     1408 3
      426 4
      310 5
      267 6
       78 7
       70 8
       47 10
       31 9
       12 13
	6 15
	6 12
	5 11
	2 14
	1 74
	1 70
	1 65
	1 41
	1 26
	1 25
	1 20
	1 17
	1 16

What is pretty interesting is that one host
    md080081101018cl.neo-sky.com:80.81.101.18
first attacked in single connects with changing sender addresses
    <[email-masked]>
and different target domains for about 3 hours, then it switched to
a 74 messages bulk inject to addresses [a-m]*@ at one single domain
from the sender address <[email-masked]> and 5 minutes later it fell
back to single connects (that still continue).

Hope this is kinda what you are looking for.

As a conclusion I'd say that due to the fact that 79.52% of the emails
already came in single recipient connections limiting SMTP conversations
to single recipients would
a) have minimal impact on the mail structure of the Internet
b) have minimal impact on the success of spammers

	\Maex

-- 
SpaceNet AG            | Joseph-Dollinger-Bogen 14 | Fon: +49 (89) 32356-0
Research & Development |       D-80807 Muenchen    | Fax: +49 (89) 32356-299
"The security, stability and reliability of a computer system is reciprocally
 proportional to the amount of vacuity between the ears of the admin"
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg