Stefan Foerster:
> * Wietse Venema <wie...@porcupine.org>:
> > Stefan Foerster:
> > > What happens after "gate" has tried to validate more than
> > > "$smtpd_soft_error_limit" invalid recipients? Will it be slowed down?
> > > Is it possible to exclude "gate" from that artificial slowdown on
> > > "hub" using smtpd_client_event_limit_exceptions?
> > >
> > > Disclaimer/for the archive: In cases like that, it's probably much
> > > better to provide a list of valid recipients to "gate".
> >
> > Tarpit delays by the hub will slow down the dictionary attack.
> > Is that a problem?
>
> It can delay legitimate mail with yet unverified recipients, but
> that's pretty much what one would suspect during a dictionary attack.
No, it does not. The documentation recommends that address verify
lookup results are cached, so they are not delayed. Postfix will
refresh these cache entries well before they expire to avoid loss
of service when the back-end host is down or slow.
This is really basic engineering.
Wietse
