🚀 go-pugleaf

In article <Pine.LNX.3.95.961128195523.4396H-100000@avarice.nepean.uws.edu.au>,
David J N Begley  <d.begley@nepean.uws.edu.au> wrote:
[snip]
>> Unfortunately, the chances that a bulk e-mailer will voluntarily use
>> `junk' precedence and thereby slow the delivery of their `urgent'
>> advert are probably pretty slim.
>
>Take a look at your next spam message - they all have "Precendence:" set
>to "high" or "urgent".  :-(

Not all, but certainly some.

>The problem with looking for large numbers of recipients neglects the fact
>that many spam messages have a single (false) recipient address, or even
>none at all.

Regardless of what is given in the content, all of the *real*
recipients must be supplied to the SMTP connection via. RCPT TO: and
hence may be counted.

The theory being that the spammers would use one connection to send
the bulk email rather than re-connecting for each message or batch. 

Whether they use 300 seperate FROM+(1)RCPT+DATA sequences or 30
batched FROM+(10)RCPT+DATA sequences you would still be able to count
that as 300 total messages (if the messages were the same) and set
the precedence appropriately.

Determining whether messages are `the same' could be simply comparing
the total chars, or perhaps the checksum, calculated on the fly as
each message is read in.

Not suggesting that this is foolproof, just a random idea ...

Regards,
-- 
Brendan O'Dea                                        bod@compusol.com.au
Compusol Pty. Limited                  (NSW, Australia)  +61 2 9809 0133