Reply to: John Tolmachoff (Lists)
Re: [Declude.JunkMail] Null Sender Spam for Valid Accounts on Thursday 11:15:50
AM
This is what I was doing but Spam Review might have 2000-10,000 of
bounced mails... too much to do in deleting them...
--
Roger Heath
[EMAIL PROTECTED]
www.rleeheath.com
----- Copy of Original Message(s): -----
J> You could put in a temporary rule that holds or routes all message with a
J> blank or <> as sender, that way the end user will not see them, but you will
J> still be complying with the requirements.
J> John Tolmachoff MCSE CSSA
J> Engineer/Consultant
J> eServices For You
J> www.eservicesforyou.com
>> -----Original Message-----
>> From: [EMAIL PROTECTED] [mailto:Declude.JunkMail-
>> [EMAIL PROTECTED] On Behalf Of Roger Heath
>> Sent: Thursday, October 16, 2003 1:53 AM
>> To: R. Scott Perry
>> Subject: [Declude.JunkMail] Null Sender Spam for Valid Accounts
>>
>> Looking at Scott's response below, I'd like to have the Refuse Null
>> Sender switch off, but we have a situation where spammers are forging
>> valid e-mail addresses. We have thousands of bounces showing up for
>> messages never sent from valid accounts here. For example,
>> [EMAIL PROTECTED] may be a valid account but he is not a
>> spammer. But a spammer uses [EMAIL PROTECTED] forges tens of
>> thousands of messages with this as the 'reply to' account in headers.
>> Since the spammer has many unvalid accounts in his spamming,
>> [EMAIL PROTECTED] is swamped with thousands of bounced mails for
>> mails that he did not even send... This is now happening to hundreds
>> of accounts here because it looks like the spammer's software is
>> randomly selecting them from a spam list.
>>
>> I have re-enabled 'Refuse Null Senders' to relieve this problem, but
>> would like to find a more compliant solution. Does any one know how to
>> attack this issue in another way?
>>
>> --
>> Roger Heath
>> [EMAIL PROTECTED]
>> www.rleeheath.com
>>
>> R> Well, the real question is why do you think that you are safer by
>> R> rejecting those E-mails? I'm not aware of any safety issues. The
>> R> only issue I am aware of is that a small percentage of spammers
>> R> send their spam that way.
>> R>
>> R> The NULL <> sender has been used for over 20 years for bounce
>> R> messages and other automated messages (such as vacation messages,
>> R> and those awful spam confirmation E-mails, and Delivery Status
>> R> Notifications).
>> R>
>> R> So the choices are :
>> R>
>> R> [1] Comply (leave "Refuse NULL <> Senders" at the default UNchecked
>> R> setting). Pros: Your mailserver will act as expected. Cons: As very
>> R> small percentage of spam is sent this way, but it can be detected
>> R> using standard spam control.
>> R>
>> R> [2] Refuse NULL <> senders. Pros: You'll have that "safe" feeling.
>> R> Cons: You won't receive all your E-mail, because you're blocking
>> R> some of it, and because you'll get listed at
>> R> http://www.rfc-ignorant.org .
>> R>
>> R> -Scott
>>
>>
>>
>>
>>
>> --
>> ActivatorMail(tm) ver.01010031 Scanned for all viruses by
>> www.activatormail.com intelligent anti-virus anti-spam service
>>
>> ---
>> [This E-mail was scanned for viruses by Declude Virus
J> (http://www.declude.com)]
>>
>> ---
>> This E-mail came from the Declude.JunkMail mailing list. To
>> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
>> type "unsubscribe Declude.JunkMail". The archives can be found
>> at http://www.mail-archive.com.
J> ---
J> [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
J> ---
J> This E-mail came from the Declude.JunkMail mailing list. To
J> unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
J> type "unsubscribe Declude.JunkMail". The archives can be found
J> at http://www.mail-archive.com.
J> --
J> ActivatorMail(tm) ver.01010031 Scanned for all viruses by
J> www.activatormail.com intelligent anti-virus anti-spam service
--
ActivatorMail(tm) ver.01010031 Scanned for all viruses by
www.activatormail.com intelligent anti-virus anti-spam service
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
