Challenge response only works if the email is not accepted for delivery prior to validation through a challenge/response routine (server side challenge/response useing message transfer agent). Accepting the email first, then challenging the sender (client side challenge/response using user agent) is not an effective way to stop spam. Once the spam has been delivered to your email server (and accepted), the spammer moves on to the next victim. Additionally, challenge/response typically (if it's using bounce responses) results in more abuse (by bouncing/replying to envelope addresses (From: or Reply-To:)), than the spam itself. The developer does not provide enough information on their web page (and there is insufficient documentation included with the download). We need more information in order to determine whether the c/r system implemented here is effective, harmful or useless. Is this an MTA or UA solution? Does it use bounce messages or server initiated responses?