Would like to see functionality similar to this:

When a message arrives from an unknown email address the message is held and a reply generated and sent back to the sender asking them to reply back with a subject line that contains a keyword, this keyword is followed by a short serial number.

If they reply back, all future messages from that person will pass through the filter, and all presently held messages from that email address will be released.

If they don't reply any future messages from them will be ignored. Since most spammers don't use real addresses, they won't ever see the registration request. If a message is held for a user defined amount of time without a reply coming back to the registration request it's purged from the system and a user defined interval.

On the sending side things work in a similar way, anyone you write to is automatically added to the friends list, so when they reply to you they will not be asked to register as they have already been registered by the simple act of you writing to them.

You can of course manage the allow and blocked mail lists manually, but why bother, unless of course a spammer manages to send you a password, if that happens simply add them to the blocked list and forget about them.

Does anyone else believe this is worthwhile, or should I stick to using two spam filter programs...

Hello cardinat.

What you are asking for is, basically, a "Challenge-Response" system. I will let to other forum members (with better english skills than me ) to explain you why these systems are not desirable, but I will pose you a question that maybe can give you some thoughts about:

Let's suppose that a spammer send 1,000,000 of junk mails with your address in the "From" part of message (that's not unusual: it's called "joe-job")...
...let's suppose that the 1% of these spam messages (10,000) end in the mailboxes of people that have a Challenge-Response system...
...and, voilá!, your mail server will be clogged with 10,000 "replies" asking you to confirm the messages sent to them "from you".

Now, start thinking that 1,000,000 of spam messages are considered an "small" campaign for the spammers this days... and you will get the figure.

@cardinat:

Your idea should be implemented on the mailserver, not client-side.
When checking with Mailwasher Pro, the mail is already accepted by
the mailserver.

Regards,
Ruud

Be prepared to have any mailserver implementing challenge response quickly blacklisted for spamming since the challenges you are sending out will be going to folks that didn't send you the spam.

They are about as bad as a fake bounce message.

http://wiki.castlecops.com/What_is_Wrong_With_Bouncing_Spam

Agree to that.

Greylisting might me a better option.

Try these links.

It may work for now but if enough folks implement it the spammers will just add a retry to the spamming programs.

http://www.google.com/search?hl=en&q=e-mail+grey+list&btnG=Google+Search

http://projects.puremagic.com/greylisting/whitepaper.html

Nifty! So the tempfail will trigger legit servers to resend, while a spam server won't get the tempfail thus won't resend, is that the idea?

Ike, That is the idea but it is not a long term fix for the problem as it is so easy for spammers to program around.

It falls into the same class as blacklisting and simple word filters, in that it will work until the spammers see profit in dealing with it in their spam generators. Adding a retry for all failed messages to either their local spam generators or the ones they run on infested computers is only a few minutes of coding.

Adding this to your server does bump your connection load on the mail server and that is something to consider for larger machines. Our RV club is seeing 13 connections per second on the average and is getting behind (busy accepting mail but not scanning for spam or delivering any to mailboxes) during peak traffic periods, doubling the connection load would not be good.

Possibilities to make grey listing less intrusive do exist, things like only refusing the initial delivery attempt from servers that fail SPF, Domain Keys, Have no MX entry in DNS and the like to expidite the smooth flow of e-mail from legitimate servers while blocking current spam servers.

OK so no time window then. Seems to be overblown if spammers can so easily defeat this mechanism.

Well blacklisting and fake bounces worked for a while until they cut into the spammers profits and the spammy #$%&**#'s updated their programs.

Right but I thought that greylisting had a time windowing mechanisim making it much more difficult for spammers.

I'm wondering if we'll ever see IPv6 widely implemented. Specs have been in place for several years but there just doesn't seem to be much of a motivation to get a more secure Internet in place.