Subject: RE: RE: [Asrg] Some data on the validity of MAIL FROM addresses

From: "Clayton, Nik [IT]" <[email-masked]>
Date: Wed, 21 May 2003 14:34:45 +0100

> >  b) The amount of horse power needed to process mail increases.  Our 
> >     stats show that roughly 40% of our inbound SMTP connections refer
> >     to multiple recipients.
>
> 
> And another thing (sorry) how much of this is spam? 

Don't know.  But that shouldn't matter, as you still have to scan the
messages to see if they're spam, irrespective of whether it's one 
recipient or 10 recipients.
 
> We're a pretty small mail system - I had a quick look at a (I hope 
> representative) set of 50000 incoming messages. We delivered these to 
> 12843 mailboxes 774 (1.5%) had multiple recipients.
> 
> Of course many of these distinct messages will have come down the same
> *connection*. There's no possiblity that there's confusion 
> here is there?
> 
> This is so much at odds with the figures you report that I'm going to
> really (no, really this time) check my script.

In the 24 hour time window I looked at, one of our servers received just
over 300,000 distinct inbound DATA transactions, some for one recipient, 
some for multiple recipients.  Had they been one-recipient-per-transaction
it would have been slightly more than 500,000 DATA transactions.

I've just run some analysis across multiple sets of log files (multiple
hosts, multiple days), and see there's quite some variance depending on
the day of the week and the relative MX weight of the host, anywhere 
between 15% and 43% of the inbound traffic having multiple recipients.

Part of that may well be due to our userbase (lots of people signed up
to many, many mailing lists).  Our Internet facing mail servers have
differing MXs so that we can (a) determine what the maximum throughput
we can expect from a particular class of host is, and (b) see whether we
get more spam coming through the higher weight MXs.  We consistently do
see more spam being sent to the higher weight MXs, which suggests that
spammers target them in the hope that they're less likely to have 
anti-spam filtering in place.

N
-- 
1        1         2         3         4         5         6         7    7
         0         0         0         0         0         0         0    5
                                                    -- The 75 column-ometer
Global Messaging,                 A: Top posting
120 Cheapside, x83331             Q: What's the most annoying e-mail habit?
_______________________________________________
Asrg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/asrg

---

From: "Jon Kyme" <[email-masked]>
Date: Wed, 21 May 2003 15:28:42 +0100

>over 300,000 distinct inbound DATA transactions, 

>Had they been one-recipient-per-transaction

>between 15% and 43% of the inbound traffic having multiple recipients.

Thank you very much for taking the trouble to produce these interesting
statistics.

>to many, many mailing lists).

I think I might have  a strange set of users.
I'd be interested to see figures from other sources.

I checked my working and it still looks good (1.7% on 250000 messages).

Oh hang on...
it occurs to me that this won't go linearly. D'oh! The more mailboxes you
have, the higher the probability that more than 1 of them will be on the
same list. I wish I could remember any maths - this is a "ball and cell"
problem isn't it?