Michael Storz wrote:
> On Fri, 16 Feb 2007, John Smith wrote:
>
> *.ro only works for whitelisting if an ip address has a reverse mapping
> and the nameservers can be reached and answer in time.
>
Also, there is no guarantee that everyone from your country reverses to
.ro. You might have a big isp reversing to something like TeleRomania.com.
I use discrimination. Not for this excact problem, but i do filter based
on tld's from well known spamming countries, especially from Asia. Also
i filter everyone who does not have a reverse-dns-record.
Many mailservers in the world simply reject mail from you if you do not
have reverse-dns, so i recon that greylisting them on my servers for not
having that record is more than fair treatment.
It would be possible to make:
client_name !~ \.ro$
Basically same result as with the whitelist, however you would still
benefit from other regex's to ie. catch dsl lines and such.
It can quickly gets a bit more hairy than the whitelist. Imagine you
wanted to pass both .ro and teleromania.com and still catch everything
called dsl, proxy and such. (just as an example)
client_name !~ (\.ro|teleromania\.com)$
client_name =~ (dsl|proxy|dailup)
But again. It all falls back to the dns-server actually answering.
Another thought would be to build in support for geoip lookups. However
that might be really really heavy to do in high-traffic environments,
but it should definitely be doable.
- Dan
|
