Filtering spam email based on retry patterns

A central problem in today's Internet is unsolicited bulk email: spam. The SMTP protocol lacks a mechanism for verifying the source of a message, and respective protocol extensions are still far from becoming standard. Content-based automatic spam filters are thus often used, and simple origin-based filtering techniques like black- and whitelists are also very common. In this paper we first analyze the retry behavior of Internet mail sources upon delivery errors. We then propose a novel spam filtering approach, founded on the results of this analysis. It is based on the observed reaction of a mail source host to temporary errors. Furthermore, evaluation results from the production use of our filter on real mail servers are given, underlining its very good performance in practice.