Rate Limiting as an Anti-Spam Tool
Opinion: ISPs need to start putting a cap on the number of e-mail messages sent by usersa policy that would leave nearly all users unaffected but would be a powerful deterrent for spammers.The spit is hitting the fan these days over the impending standards for SMTP authentication. Im a big fan of it, but many are arguing against itsome constructively and some not. One of the main dismissive put-downs against authentication, especially with respect to zombied PCs, is that spammers and worms will simply switch to using the users authenticated ISP account to send spam. There are a number of reasons why Im not so worried about this. One of them is that ISPs, at least consumer ISPs, will need to begin limiting the number of e-mail messages sent by users. This is one of those policies that will leave 99-something percent of all users unaffected but generate extreme rage among the others.
Hard limits are not a good way to implement changes like this. What is needed is what we call "rate limiting"limiting the amount of mail users can send over some period of time. When you do this, you implicitly limit the total amount of mail they can send and, as a practical matter, can make high-volume spamming impractical.