NewIP

Submitted by April Lorenzen, assigns rights to Server Authority, Inc:

The following was submitted during tests of the form posting process:

NewIP --AprilDL, Sun, 01 Feb 2004 18:57:56 -0500 reply
Assumption: Email messages sent by viruses don't retry after receiving a tempfail. This is an untested assumption.

Proposed Check: Store all sending_ip's in a table. Tempfail any new ip addresses for queries where no decisive response is found from other checks.

Dangers: Careless combination of cache timeout could cause legit new senders to always be tempfailed. The use of other whitelisting factors prior to tempfailing or properly forseeing unwanted operational modes, could protect against this.

Tables/columns:

There may be faster ways to store the data for this check than an sql database. At least the sender_ip and a timestamp would need to be stored. first_seen and last_seen timestamps might be useful.

Describe the logic needed for your desired outcomes:

Pass if sending_ip exists in table, pass action: Continue

Fail if sending_ip not in table, fail action: Tempfail

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Additional Comments:

Place this check after all other checks. If any other check finds a definitive answer, the result of this check should be ignored.