Re: [Declude.JunkMail] blocking spam faked as coming from local a ddress ddress

[Matthew Bramble]

I get more valid E-mail's faking the from to look like it's from one of my users than I get in actual spam that is doing this.  In a recent test of 5,530 unique incoming messages, only 6 spammers tried to look as if it was coming from my server, that's only 0.1%.  It all failed as well. I highly recommend not filtering the fake MAILFROM for your local domains. Matt Colbeck, Andrew wrote: I should add:   If you want to go the extra mile and say:   MAILFROM 20 ENDSWITH wcnet.net   Then you'll find that works great against spammers who fake their mailfrom address so it looks your own name (or say, [EMAIL PROTECTED] while trying to send to you!), but:   You'll also find that it works "great" to also block mailing lists, news subscriptions, and greeting cards that use the name of the destination mailbox as the mailfrom.  One example is the sabre.com travel service, and another is pretty well any newspaper where somebody can read an article and forward it somebody.   So, although it looks like a great idea, to implement will take a lot of work on your part to look for false positives (preferably ahead of time).  And your counterweight section will be different from mine, and his, and hers over there...   Andrew 8) -----Original Message----- From: Glenn \ WCNet [mailto:[EMAIL PROTECTED]] Sent: Friday, September 19, 2003 10:23 AM To: [EMAIL PROTECTED] Subject: [Declude.JunkMail] blocking spam faked as coming from local address How do I reliably block this kind of thing?  Can my own domain be added to the SpamDomains list?  I've replaced the recipient address with [local-user] in the headers below, but it was the same valid local user account on all parameters.  138.89.104.227 is not one of my IPs.   Glenn Z.     Received: from wcnet.net [138.89.104.227] by wcnet.net with ESMTP (SMTPD32-7.15) id 04542B014C; Thu, 18 Sep 2003 23:04:21 -0500 Received: from kennedy-henry [192.168.1.101] by wcnet.net with MailMXPro2(2195.5631); Fri, 19 Sep 2003 00:04:20 -0400 Message-ID: <[EMAIL PROTECTED]> From: "jenna henny" <[EMAIL PROTECTED]> To: <[local-user]@wcnet.net> Subject: Spam (10) - Don't wait for rates to climb back up Date: Fri, 19 Sep 2003 00:04:20 -0400 MIME-Version: 1.0 Content-Type: text/html; charset="ISO-8859-1" X-Priority: 3 X-Mailer: mailer Return-Path: [local-user]@wcnet.net Abuse2-Tracking: <Z2xlbm5jbXpAd2NuZXQubmV0> X-Declude-Sender: [local-user]@wcnet.net [138.89.104.227] X-Declude-Spoolname: D8045042b014c3731.SMD X-Note-In: This E-mail was scanned on MAIL1 by Declude JunkMail for evidence of spam. X-Spam-Tests-Failed-In: SPAMCOP, IPNOTINMX, SNIFFER, WEIGHT10 X-Note-In: Total spam weight of this E-mail is 13. X-Note-In: This E-mail was sent from pool-138-89-104-227.mad.east.verizon.net ([138.89.104.227]) X-Note-In: SMTP Real From: [local-user]@wcnet.net X-RCPT-TO: <[local-user]@wcnet.net> Status: R X-Mozilla-Status: 0000 X-Mozilla-Status2: 00000000 X-UIDL: 8400