When to filter? SMTP time? means you don't have to bounce email more vulnerable to DOS attacks very bursty load per-message overhead or later? bounces mean collateral spam controllable load overhead amortized per batch available software is more flexible