Challenge-Response Spam Filters: Are They Worth The Inconvenience?

I manage a number of email lists through the NAISG security group. Users can subscribe to the TechTips list, as an example, simply by filling out a form on the Web site, providing their name and email address and then clicking the Submit button. Once they complete this relatively simple step, they will receive messages from the list and be able to send as well.

But an increasing number of end-users employ challenge-response spam filters, in which the sender must first verify to the recipient that he/she is legitimate. Here's how it works: The Quintessential Geek sends an email to Joe@shmo.com, who has a challenge-response spam filter. Before the spam filter will allow TQG's email to get to Joe, the filter sends a reply to TQG indicating that TQG must verify that he is a real person, perhaps by reproducing a series of characters or some other morsel of information. Having done that, the filter will finally allow TCQ's message (and all future ones) to get to Joe.

While TQG understands the importance of spam filtering (after all, he would receive nearly 400 spam messages per day through his various email accounts if not for Postini), he really winces at the fact that he needs to take this extra step just to send someone else an email. This is especially the case when the original sender (Joe Shmo) explicitly requested to be on a list such as TechTips.

Darn it, Joe... if you're smart enough to setup a challenge-response spam filter for yourself, can't you also add the TechTips list address to the filter's white list ahead of time so that TCQ doesn't need to jump through this extra hoop for you and every other subscriber that has this type of filter?

***END OF RANT***