Medium term rate and resources limiting

While Short term rate control takes actions based on values gathered on a short time period (10 minutes) and for all sources, Medium term rate control is intended to take actions based on unwanted or suspect behaviour over a much longer time period (~ 4 hours).

For the moment, the following values are evaluated, but only the first two are directly used to reject connections. The others are used indirectly to reduce privileges or make “life” harder for SMTP clients behaving this way.

  • Bad recipients
  • Too many empty connections
  • Spamtraps
  • Bad MXs
  • Too many spams (evaluated by content filters)
  • Too many virus or xfiles
CHECK_BADRCPTS                 YES
MAX_BADRCPTS                    10
MAX_EMPTY_CONN                  10

This control can be seen as a dynamic realtime blacklist or some sort of auto maintained dynamic reputation list.

This is a field which is still evolving inside ze-filter and new evaluations and uses are still being created.

doc/spam/medium_term_rate.txt · Last modified: 2017/12/01 11:57 by
CC Attribution-Noncommercial-Share Alike 4.0 International
Driven by DokuWiki Recent changes RSS feed Valid CSS Valid XHTML 1.0