On Wed, 23 Sep 2020 12:13:48 -0700
Ian Zimmerman <itz@???> wrote:

> On 2020-09-23 12:15, terryc wrote:
>
> > The norm seems to be to just accept everything and process it, but
> > until recently, all my internet services cam with a data charge. So
> > for our domain, the easiest & cheapest method is just to block known
> > spammers and not pay data charges.
>
> Much depends on what you mean by "block".
>
> You can reject connections from known spammer IPs at the IP level via
> iptables or via tcpwrappers.

We list only a few in the firewall.

> You can also reject _delivery_ of
> messages at the SMTP level with a 400 or worse status code.

We do a lot of that. To get to that stage, they have to be a
notice repeat offender

> But once you accept a message with a
success status after the DATA stage,

The idea is not to get to that stage as that is where the costs are.

> you
> are obliged to either really deliver it or else bounce it back. It is
> not acceptable to send messages down a "black hole".

Where does that come from?

Yep a human decides at that stage. Claws ussers usually flick it to
spamcop as spam. the rest just dump it. Since the spamcop confirmations
all get processed by me, I get to notice the repeat offenders and
they'll go on the permanent black lst.

That explains why gmail, hotmail, yahoo, live etc are all in the block
list. I take the philiosophy that if it is spam, you dump it and you
can discuss it with your 'user/customer'. I am definitely under no
obligation to incurr costs to 'accept' spam so someone else/company can
make money selling services to spammers.

>
> > FWIW, I do not accept email by IPv6.
>
> I am interested to know the specific reason for this. You know that
> the RBLs do list IPv6 addresses, right? In fact, I just enabled IPv6
> in my own mail server a couple of days ago, and voila I ended up in
> zen (not having done all of my homework).

The whole process of someone responding to spam and the source getting
black listed takes too long to consistently keep costs down.

IPv4 is enough of a pipe without taking on the flood IPV6 would
allow. FWIW, my ISP/RSP so generously give people a block of IPV6 /60
addresses and you can select /56 if you want them. you can also
randomly swap them.

I'll just end up with the equivalent of blocking by class again.

I've been running a domain mail server for over 20 years(?). What we do
works for us.