No Postfix, but something I may think about. I've been meaning to for a while, but it seems I really need to upgrade to Pro, huh? <grin>
Darin. ----- Original Message ----- From: "Bill Landry" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, October 20, 2004 9:21 PM Subject: Re: [Declude.JunkMail] Random Helo strings ----- Original Message ----- From: "Darin Cox" <[EMAIL PROTECTED]> > I guess my rules aren't quite to the point where I can clearly separate the > legit mail with bogus HELOs from the spam....without relying on other tests > in a weighting system. That's why it wouldn't work for me to block on this > alone. > > Perhaps you have some better rules in place that some of us are not familiar > with and could utilize? If you are running a Postfix gateway in front of your IMail/Declude server, I can certainly help you out, and would be will to do so. > For example, I just saw one tonight that forged one of our domains as the > HELO, but didn't get detected. I thought there was a test to check the HELO > against the Reverse DNS? Here are a couple of examples of how you can block these with Declude JunkMail Pro: In a filter file: HELO 10 ENDSWITH your.hostname.com HELO 10 IS xxx.xxx.xxx.xxx <=== your IP address Another way is to add weight for e-mail message that claim to be from one of your domains ([EMAIL PROTECTED]). In a spamdomain file: @example1.com .example1.com @example2.com .example1.com Anyway, keep up the good fight! Bill --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
