Adjustments to Tar-pitting for ExchangeDefender | ExchangeDefender [ Skip to content ](#main) [ ![ExchangeDefender](/assets/images/xd_logo_blue.png) ](/) Email Security ![Platform Overview](/assets/images/m-xd-pro.png)### ExchangeDefender PRO Enterprise-grade email security made simple for every business. [Sign Up](/sign-up) [Live Demo](/demo) [Email Security Stops spam, malware & phishing in real time. ](/email-security) [Encryption Secure your emails, attachments & sensitive data. ](/corporate-email-encryption) [Web File Sharing Easy, safe cloud file sharing with access control. ](/web-file-server) [Live Archive Locked-in email backup & continuity during outages. ](/livearchive-backup) [Emergency Inbox Keep email flowing without interruption if your provider fails. ](/inbox) [Spearphish Train your team with phishing simulations & risk tracking. ](/spearphishing) Managed Email ### Enterprise-Grade Managed Email Reliable, secure, and fully managed email operations for modern organizations. ![ExchangeDefender](/assets/images/managed_email_menu.png) [Microsoft365/Google Email Management Expert management and security for Microsoft 365 and Google Workspace email. ](/managed-email-operations) [AI Advisory Secure, practical AI consulting & implementation for SMBs. ](/management-ai) Company ### ExchangeDefender: 29+ Years of Trust We are a cybersecurity company focused on business email protection, with 29+ years of experience keeping organizations secure, connected, and resilient. ![ExchangeDefender](/assets/images/careers_1.png) [ About Us Learn our purpose, values, and the mission behind every decision. ](/about-us) [ Blog News, product updates and email security insights. ](/blog) [ Capabilities Discover the tech and expertise that keep your email secure around the clock ](/capabilities) [ Careers Be part of a team using modern tech to solve real threats and ship great work. ](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human Open menu Menu ---- Email Security [Email Security](/email-security) [Encryption](/corporate-email-encryption) [Web File Sharing](/web-file-server) [Live Archive](/livearchive-backup) [Inbox](/inbox) [Spearphish](/spearphishing) Managed Email [Microsoft365/Google Email Management](/managed-email-operations) [AI Advisory](/management-ai) Company [About Us](/about-us) [Blog](/blog) [Capabilities](/capabilities) [Careers](/careers) [Partners](/partners) [Docs](/docs) [Contact Us](/contact) Talk to a Human January 10, 2007 · [ExchangeDefender](https://www-preview.exchangedefender.com/blog?category=exchangedefender) Adjustments to Tar-pitting for ExchangeDefender =============================================== Earlier today we have made some significant changes to the tar-pitting mechanism under ExchangeDefender. The new mechanism is designed to reject messages from hosts that do not follow the proper RFC SMTP dialog and attempt to smash tar-pitting. More on the basic concept of [tar-pitting is described here](http://www.ownwebnow.com/blog/2006/12/exchangedefender-begins-managed-tar-pitting-back-scatter/). **The Problem** While tar-pitting is great for throttling remote mail servers and reducing their ability to efficiently deliver a lot of messages, the concept only applies against botnet servers that are attempting to deliver mail in bulk. Anotherwords, tar-pitting is only effective against servers that are concerned about getting the message out as fast as possible. By delaying the SMTP greeting banner, in theory, the remote mail server would have to wait a pre-determined amount of time before starting to send mail. Many open connections at once would overload a single node. However, spammers no longer exclusively use single nodes in a full force attack. They use the botnet concept by load balancing their broadcasts through multiple servers. As such, those servers connect every few minutes and only relay a single message. By doing so its hard to blacklist them immediately because their overall reputation does not have enough data to be determined. These botnets are designed to bypass tar-pitting by opening a connection and sending data as soon as the connection is opened. The conversation looks somewhat like this: > Trying xx.xx.xx.xx.exchangedefender.com. > > Escape character is '^\]'. ehlo spamming-idiot.org mail from: rcpt to: data Subject: Get a college diploma. Ohio State University may be a loser but they'll give you a Ph.D in nuclear physics based on your life experience. . Now the (target) tar-pitting mail server has accepted the connection but it has never sent the SMTP greeting. However, it will process the message as soon as its tar-pitting interval passes, thus in part bypassing the tar-pitting and delivering the message. Not good. Notice that the client above did not wait for the 200 greeting banner, did not wait for the 250 Hello, did not wait for the server to acknowledge the recipient and the sender. They just wrote to the socket and waited. Now even though this does diminish the spammers performance a little (by taking 5 seconds to deliver the message) the message still gets delivered. That’s a problem. **The Solution** The solution is fairly simple: Drop connections with mail servers that are not adhering to RFC. The second the mail server issues a command before the 2.2.0 hostname greeting banner it will get dropped, logged and its tar-pitting interval extended. Instead of a tar-pitting process that delays the connection a few seconds, this process allows for a connection immediately but delays the SMTP greeting banner a few seconds. As such, it can eliminate server load caused by spammers that think they have found a way around tar-pitting. We ran this in testing on our production systems and have found 0 false positives over the course of one week. All hosts that were rejected were also on multiple RBLs. The implementation is transparent to the user and administrator and introduces a random (less than 5) second pause on all connections that do not have a reputation rating with ExchangeDefender. Less spam, less stuff to review, less bandwidth and less stress for you. [ Previous post The Grinch that stole Quarantine Reports December 25, 2006 ](https://www-preview.exchangedefender.com/blog/2006/12/the-grinch-that-stole-quarantine-reports) [ Next post ExchangeDefender Adds Two New Data Centers January 10, 2007 ](https://www-preview.exchangedefender.com/blog/2007/01/exchangedefender-adds-two-new-data-centers) Related Posts ------------- [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2026/04/xd10.png) 2 Apr ](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10)### [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [Read more: Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/09/Top-7-IT-Solutions-Every-Small-Business-Needs-in-2025.jpg) 30 Sep ](https://www-preview.exchangedefender.com/blog/2025/09/top-7-it-solutions-every-small-business-needs-in-2025)### [Top 7 IT Solutions Every Small Business Needs in 2025](https://www-preview.exchangedefender.com/blog/2025/09/top-7-it-solutions-every-small-business-needs-in-2025) [Read more: Top 7 IT Solutions Every Small Business Needs in 2025](https://www-preview.exchangedefender.com/blog/2025/09/top-7-it-solutions-every-small-business-needs-in-2025) [ ![](https://storage.services.exchangedefender.network/exchangedefender-blog/blog/2025/09/Website-Active-Image-10.jpg) 23 Sep ](https://www-preview.exchangedefender.com/blog/2025/09/exchangedefender-rolls-out-advanced-reject-policies-for-safer-inboxes)### [ExchangeDefender Rolls Out Advanced 'Reject Policies' for Safer Inboxes](https://www-preview.exchangedefender.com/blog/2025/09/exchangedefender-rolls-out-advanced-reject-policies-for-safer-inboxes) [Read more: ExchangeDefender Rolls Out Advanced 'Reject Policies' for Safer Inboxes](https://www-preview.exchangedefender.com/blog/2025/09/exchangedefender-rolls-out-advanced-reject-policies-for-safer-inboxes) Search the blog Search Recent Posts ------------ - [ExchangeDefender New UI is Live](https://www-preview.exchangedefender.com/blog/2026/05/exchangedefender-new-ui-is-live) - [Announcing ExchangeDefender 10](https://www-preview.exchangedefender.com/blog/2026/04/announcing-exchangedefender-10) - [Merry Christmas](https://www-preview.exchangedefender.com/blog/2025/12/merry-christmas) - [Why IoT Devices Are a Hidden Security Risk for Your Business](https://www-preview.exchangedefender.com/blog/2025/11/why-iot-devices-are-a-hidden-security-risk-for-your-business) - [Top 5 IT Problems Small Businesses Face in 2025 — and How to Fix Them](https://www-preview.exchangedefender.com/blog/2025/10/top-5-it-problems-small-businesses-face-in-2025-and-how-to-fix-them) Categories ---------- - [Archiving](https://www-preview.exchangedefender.com/blog?category=archiving) (21) - [Business Continuity](https://www-preview.exchangedefender.com/blog?category=business-continuity) (13) - [Compliance](https://www-preview.exchangedefender.com/blog?category=compliance) (8) - [ExchangeDefender](https://www-preview.exchangedefender.com/blog?category=exchangedefender) (349) - [General](https://www-preview.exchangedefender.com/blog?category=uncategorized) (590) - [Hosted Services](https://www-preview.exchangedefender.com/blog?category=hosted-services) (86) - [Industry News](https://www-preview.exchangedefender.com/blog?category=industrynews) (29) - [Marketing](https://www-preview.exchangedefender.com/blog?category=marketing) (18) - [Phishing](https://www-preview.exchangedefender.com/blog?category=phishing) (5) - [PRO TIPS](https://www-preview.exchangedefender.com/blog?category=pro-tips) (44) - [Product Features](https://www-preview.exchangedefender.com/blog?category=product-features) (54) - [Security](https://www-preview.exchangedefender.com/blog?category=security) (65) - [Shockey Monkey](https://www-preview.exchangedefender.com/blog?category=shockey-monkey) (22) - [Spamfilter](https://www-preview.exchangedefender.com/blog?category=spamfilter) (5) - [Support](https://www-preview.exchangedefender.com/blog?category=support) (45) - [Webinars](https://www-preview.exchangedefender.com/blog?category=webinars) (44) Solutions --------- - [Stop Spam & Malware](/email-security) - [Hands-Free Email Backup](/livearchive-backup) - [Instant Email Recovery](/inbox) - [Send Private Emails](/corporate-email-encryption) - [Train Against Email Threats](/spearphishing) - [Share Files Safely](/web-file-server) Company ------- - [About ExchangeDefender](/about-us) - [Compliance & Legal](/our-compliance) - [Become a Partner](/partners) - [Support Portal Login](https://support.exchangedefender.com/) - [Microsoft 365 Email Management](/managed-email-operations) - [AI Advisory Service](/management-ai) ![ExchangeDefender](/assets/images/dark-xd-logo.png)USA: +1 (407) 465-6800 United Kingdom: 0800 8620149 Australia: +61 0390010641 Fax: +1 (954) 839-8737 [ ](https://www.facebook.com/ExchangeDefender) [ ](https://www.twitter.com/XD_Defender) [ ](https://www.linkedin.com/company/exchangdefender) [ ](/blog) © 2026 Own Web Now Corp - All rights reserved </> with ❤️ in Orlando [SLA](/sla) [TOS](/tos) [PRIVACY](/privacy-end-users) [AUP](/aup) We're Here to Help 👋 -------------------- Tired of AI 🤖 and hold music? Request a call or text (sms/telco charges may apply) and someone with a brain and a pulse will get in touch with you promptly. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Human Contact Submitting... Close Start Your Free Year -------------------- Enter your details and we will set up your free year of email protection. Close modal Website Full Name Email Continue Submitting... Close Try ExchangeDefender for Free 💰 ------------------------------- We look forward to helping you secure your email. We offer a free 30-day no-risk trial, just fill out the form below and one of our onboarding techs will get you started. If you'd just like to take a look at the demo, click here for a [live demo site](/demo). Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney 💰 Get your free month Submitting... 🏃 Explore a Live Demo Submitting... Close Train Your Team Before the Hackers Do 👋 --------------------------------------- ExchangeDefender Spearphish is our new phishing simulation and training tool, designed to help your team spot scams before they click. Want to be first in line? Request early access or get a personal demo — just drop your name and email below. Close modal Website Name Email Address Company Phone Preferred Contact Method Text me Call me Call Date Call Time Time Zone Eastern Central Mountain Pacific London Paris Madrid Berlin Tokyo Dubai Sydney Request Early Access Submitting... Close