used widely enough to make spammers bother to (automatically) respond to challenges. Therefore, C/R systems generally just rely on a simple challenge that would be made more complicated if spammers ever build such automated responders. Recommendations for C/R systems C/R systems should ideally: Allow users to view and act on messages in the holding queue. Comply with the requirements and recommendations of . Obey a detailed list of principles maintained by Brad Templeton, including allowing for the creation of “tagged” addresses or allow pass-codes placed in either the header or the body of the message—any of which lets messages be accepted without being challenged. For example, the TMDA system can create "tagged" addresses that permit: mail sent from a particular address mail that contains a certain “keyword” mail that is sent within a pre–set length of time, to allow correspondence related to an online order, but which then expires to disallow future marketing e-mail. Problems with sending challenges to forged email addresses can be reduced if the challenges are only sent when: the message header is properly formed the message is sent from an IP address with an associated domain the server has passed a greetpause test the server has passed a greylisting test the originating IP address is not found on trusted blacklists the sender's email address has not failed an E-mail authentication test, using techniques such as SPF and DKIM. Criticisms Critics of C/R systems have raised several issues regarding their legitimacy and usefulness as an email defense. A number of these issues relate to all programs which auto-respond to E-mail, including mailing list managers, vacation programs and bounce messages from mail servers. Challenges sent to forged email addresses Spammers can use a fake, non-existent address as sender address (in the field) in the e-mail header, but can also use a forged, existing sender address (a valid, but an arbitrary person's address without this person's consent). The latter would become increasingly common if e.g. callback verification would become more popular to detect spam. C/R systems challenging a message with a forged sender address would send their challenge as a new message to the person whose address was forged. This would create e-mail backscatter, which would effectively shift the burden from the person who would have received the spam to the person whose address was forged and which may be treated the same as any other Unsolicited Bulk Email