[bawolff]

> Or just use Hashcash or any other PoW.

People love the idea of this, but i don't think it really makes sense.

How high do you set the PoW to? I dont think there is any middle ground that would actually deter attacks but not deter legit users.

[SXX]

When I have personal email server and I need just ocasionally send email or two it can be as high as possible.

I just want them delivered not into Spam folder.

[bawolff]

Yeah, but you pay the cost for outgoing messages and set the cost for incoming messages. The incentives aren't super well aligned, and its difficult to convince people to pay a cost to contact you when they cant force it to be reciprocal.

The point i was trying to make though, is that we are past the era of brute forcing email addresses to send spam. Most spam is at least a little targeted.

If you are an attacker and need to send 100,000 emails a week, that means your budget you can spend on each PoW is six seconds.

This is easily parallizable and you can get budget vps's for about $5/month (i dont know if its more ecconomically efficient to get more powerful VPS or lots of cheap ones, but your mail server is probably in the range of a budget vps so i think its a fair comparison).

So some back of the napkin math, if the marketer wants to send 100,000 emails a week it costs them very very roughly $1.25 per 6 seconds of PoW.

If they have a marketing budget of $500 (which seems very small by most advertising budgets). Then you need a proof of work that takes 40 minutes per email to deter them. I dont think most email providers would find that acceptable, and i also made a bunch of simplifying assumptions here that i think lean in the direction of making PoW sound better than it is.