> Seems to me that this would add a LOT of false positives, especially > from larger ISPs where the outgoing relay servers aren't necessarily > the same as the incoming (the only ones listed in MX records) smtp > servers.
> Am I all wet on this? I agree with you completely. In fact, even with tiny clients, we often have the IMail mailbox server send directly, while the MX is on a different box. If the test included subnet-based weighting, it might be more useful; yet this would only apply to single-provider locations and not solve the problem of virtually or geographically distributed systems committing the crime of being well-architected! I imagine it would detect the MAIL FROM: = RCPT TO: method, if it could be confined to checking local domains only (and if the sysadmin were sure that s/he did not have users BCC:'ing themselves, as discussed earlier). -Sandy --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
