> Could the work requirement be advertised as part of the destination's MX record or something? The frustrating part is that only the good guys would follow su

> Could the work requirement be advertised as part of the destination's MX record or something? The frustrating part is that only the good guys would follow such a scheme. As long as there's a fallback available, no matter how deprecated, spammers will use it to avoid such payment schemes. I suppose it could be used as a strong signal for spam filters, in addition to other security/authentication schemes which have been adopted. > Another problem is finding a quantity of work which is high enough to stop spam, but low enough not to stop legitimate traffic. Yes, this is another problem which negotiation could alleviate. These days there would also be the option of offloading the actual email sending to a service (either run on your own server, or "in the cloud"). Of course this just shifts the problem, but at least such services can provide arbitrary APIs, and hence can restrict their hashcash power to authenticated users, or require users to provide proof of work in a way which can be negotiated down, e.g. by building up a reputation over time. Not sure how botsnets can be tackled, but raising the amount of effort even a small amount would hopefully make a lot of spam-based scams unprofitable. I'm sure the problem would just shift then, e.g. to using the botnets for more DDoS attacks or other more lucrative schemes.