2016-06-02
Spammers can abandon SMTP connections not infrequently
As a result of looking at my SMTP session logs, one of the things that I've started tracking on my 'sinkhole' spamtrap SMTP server is how many senders reach the point where they actively get rejected by my server versus how many senders just disconnect with incomplete sessions where everything has gone fine up to that point. My SMTP session logging said that at least some just gave up, but I wasn't sure how many did this.
(Under normal circumstances you'd expect real sending mailers to almost never just abandon an incomplete session. It's not 'never' because there will always be some sending mailers that have their machine reboot out from underneath them or the like as they're trying to send out a message, but this is not exactly common so it should be very low.)
My results so far are early and somewhat incomplete, but I'll give
you representative numbers anyways. The numbers I have handy right
now are that over the past two and a half days, I've seen 123
abandoned sessions to 440 sessions with refused SMTP commands, or
about a fifth of the sessions are just being abandoned. I don't
particularly have data on where the sessions are being abandoned,
but looking at my SMTP logs say that some senders drop the connection
while I'm sending my initial SMTP greeting banner and some drop it
as I answer their EHLO or HELO.
Now, I don't and can't know why senders are choosing to abandon their SMTP sessions to my sinkhole server. But one thing that my server does is trickle out its SMTP replies rather slowly (including the initial banner), specifically at a rate of one character every tenth of a second. I took this idea from OpenBSD's spamd, but when I put it in I didn't really expect it to do anything. It may be that I'm wrong here and there is a not insignificant amount of spammer software that either specifically recognizes this behavior or simply isn't interested in wasting its time on too-slow mailers.
(I don't yet feel like experimenting by turning this feature off and seeing if the number of abandoned sessions basically goes almost to zero.)
Applications of this to real, non-sinkhole mailers are left as an exercise. As far as I know, no real sending mailer cares about somewhat slow responses at this level, but I admit I haven't exactly attempted to get every major ISP and so on to send my sinkhole server some email just to see if it would work. Big places like Google and Outlook don't seem to have had any problems coping with my sinkhole server, for what that's worth.
Sidebar: what I consider an abandoned session versus a rejected one
A session counts as 'rejected' if the most recent valid HELO/EHLO,
MAIL FROM, RCPT TO, DATA or final '.' on messages was either
5xx'd or 4xx'd. This doesn't consider QUIT, RSET, or other
similar commands and it doesn't consider out of sequence commands.
A session counts as 'abandoned' if it got 'go ahead' 2xx/354 responses
to every valid, in-sequence SMTP command it tried but the sender
either closed the TCP connection or sent a QUIT.
Sessions with things like TLS setup failures don't count as either abandoned or rejected. I see some amount of those, some for sad reasons.