Date: Sun, 6 Jun 1999 22:02:59 -0400
Message-Id: <199906070202.WAA04331@saint.heaven.net>
From: "Dick St.Peters" <stpeters@NetHeaven.com>
To: "D. J. Bernstein" <djb@cr.yp.to>
Cc: ietf@ietf.org, drums@cs.utk.edu
Subject: Re: Asinine anti-spam mechanisms
In-Reply-To: <19990606060920.22356.qmail@cr.yp.to>
References: <19990606030904.21624.qmail@cr.yp.to>
	<199906060337.XAA09500@astro.cs.utk.edu>
	<19990606060920.22356.qmail@cr.yp.to>

D. J. Bernstein writes:
> If retries are too complicated for your software, you shouldn't accept
> the mail in the first place. The remote SMTP client will try again later
> if you send it a 4xx code.

If the remote client is an NT server running Microsoft SMTP without an
update Microsoft issued in March, it will try again immediately if you
send it a 4xx code.  "Immediately" means up to 6 times per second for
the cases that we've logged here.  The first report of this on bugtraq
was of a case of an NT server attempting to deliver a message 200,000
times in one day.

We had cases involving tens of thousands of attempts in our own logs
but had attributed them to intentional denial of service attacks on
our mail servers.  They stopped happening when we began returning 5xx
error codes.

That, BTW, was Microsoft's suggestion too.

(To Microsoft's credit, they promptly acknowledged the problem and
fixed it - but there are lots of NT systems out there that have not
had the update applied.)

--
Dick St.Peters, stpeters@NetHeaven.com 
Gatekeeper, NetHeaven, Saratoga Springs, NY, 1-800-910-6671 (voice)
Saratoga/Albany/Amsterdam/BoltonLanding/Cobleskill/Greenwich/
GlensFalls/LakePlacid/NorthCreek/Plattsburgh/...
	  Oldest Internet service based in the 518 area code