John,

I assume that if someone is going to spoof part of my domain, they won't add fake stuff to the front of it.  If they started, I would change my methods to yours possibly, but I would then need to provide exceptions for where my domains are validly used on other servers, such as my MS SMTP server which is webmail.igaia.com whereas my IMail domain is just igaia.com.  This might not be an issue for you, or for many.

Matt



John Tolmachoff (Lists) wrote:
despite the lack of scoring.  I'm using some other tweaks such as doing
an IS instead of CONTAINS for the FQDN, and listing the addresses with
and without the mail. in front of my domains since my MX records use the
mail. subdomain.
    

Acutally, would it not be better to use ENDSWITH rather than IS?

Your way, if a message HELO was fkdhoosl.example.com, it would not be
caught, but if using ENDSWITH it would be.

John Tolmachoff MCSE CSSA
Engineer/Consultant
eServices For You
www.eservicesforyou.com

  

Reply via email to