Tarpitting
A defence in which a mail server deliberately delays its SMTP replies to clients it suspects of abuse, making bulk probing and dictionary attacks slow and expensive.
What it means
A tarpit holds back responses so that a client trying many addresses or passwords is slowed down on every attempt. Microsoft Exchange has it built in: a receive connector's TarpitInterval delays SMTP responses to a remote server that might be abusing the connection, 5 seconds by default, and AuthTarpitInterval does the same after failed authentication attempts. Microsoft warns that values above a few seconds can cause timeouts and mail flow problems.
To a sender a tarpit shows up as slow sessions and timeouts rather than as rejections, so a sudden drop in throughput to one destination with no change in replies can be the sign.
Related terms
Sources
What this definition rests on. The wording is ours; the facts are theirs.
- Microsoft Learn: Set-ReceiveConnector (TarpitInterval, AuthTarpitInterval)learn.microsoft.com
All 432 terms in the glossaryThe wiki: blocklists and bounce codes