karl and paul, expostulating

Warning: there is actual technical content contained herein. If you joined
NANOG just to hear endless nontechnical drivel, do not read this message.

Again, wrong Paul. Sending back 421s to the spammers force them to waste
not only the connection time, but the scan time on their disks. If lots of
people do it they back up thousands of email messages, and THAT breaks their
mail servers. This is a very good thing. Its even uglier than the 75
seconds, in that its cumulative and probably keeps that nice message on
their disks (where it eats resolver resources, storage, and useless attempts
at delivery) for up to five days.

Much more elegant, in my opinion.

I don't think so. I remember the 421 discussion but the problem is that it's
too easy for a spammer to reprogram their sending agent to treat it as a 500.
With a lack of SYN-ACK all they can do is turn down their TCP connect timers,
and if they turn them down low enough to avoid being hurt by my blackhole list
then they will also give up on a large number of valid recipients -- we all
win either way.

No argument -- as long as a public root server isn't there. If it wasn't
I'd be SUPPORTING your black-hole list. But it is, and as such I'm not.

I had no idea this would be anyone's position. So be it. I'll put up an
internal firewall to segregate F onto a blackhole-free subnet. This will
take a week or so due to other time commitments.

Nonsense. Why not distribute the "block the SMTP port" list instead?

Because every Sendmail relay or end host would have to upgrade, and some
sites run NT without Sendmail and they depend on vendors to do the updates.
BGP relies on an existing infrastructure and it just works today, right now.

The point is, you can do that, hurt the spammers even more, and still find
ways to distribute the file (it IS only a flat file Paul) on an automated
basis, rapidly, if you want.

  if (strncmp(response, "421", 3) == 0)
    strncpy(response, "501", 3);

AND, you don't cut off a non-related resource (a root nameserver) in the

That's a separable issue as you well know. I will separate it shortly. Can
I expect a request from MCS for the blackhole feed in the next few weeks?