Blocking Connections As Opposed to Messages

Customers find that adding Email Reputation Services to their anti-spam solutions has an exponential impact on offloading existing filtering solutions. What can appear to be only a small increase in blocked connections can translate into a large reduction of actual messages entering the filtering portion of their email infrastructure.

Translating blocked connections into blocked messages is more involved than simply applying a 1:1 ratio. Studies show that while legitimate sources average slightly more than one message per connection, each connection from a spam source contains, conservatively, an average of 1.6 messages.

It is far more efficient to reject spam at the connection level rather than take each message through full anti-spam scanning.

Table 1. Connection Blocking and Scanning Requirements

Connection Blocking Requirements

Scanning Each Message Requirements

The initial portion of the SMTP handshake

The full SMTP-handshake

A DNS query

Complete message parsing, putting strains on computers that run anti-spam solutions