4 ms·
> IP reputation while not perfect is still a useful layer of lipstick on the SMTP pig. just use the prefix for reputation. You can assume that each user will h
by pilif 9y ago
> IP reputation while not perfect is still a useful layer of lipstick on the SMTP pig.
just use the prefix for reputation. You can assume that each user will have received a /48. Yes. There are some ISPs out there handing out /64's or even a /128, so it might be somewhat too broad, but blacklisting a the whole /48 and then white-listing on (rare) demand is probably the way to go.
- philjohn 9y agoCurrent recommendation is actually for a /56.
- zrm 9y agoIf you assume the user has a /48 when they really have a /64, you're off by a factor of 65536. For address blocks allocated to business customers, a nontrivial percentage (say 10%) may be operating mail servers. Which means that one misbehaving customer will cause you to block thousands of honest ones. That's a lot of white listing to do.