Say for example I have 10,000 people using MSN.com addresses to spam me with.
I add the spamdomains test and enter in @msn.com into it. Now it does well to stop the spammers, but now I am falsely tagging mail from ebay.com [EMAIL PROTECTED] making a bid inquiry. If we could have a spamdomains RDNS whitelist, then anything with a .ebay.com address is whitelisted, or whatever we put in the list. I know we can whitelist in the main .cfg file, but I'm not sure I would want to whitelist ebay from every test, just whitelist from the spamdomains test. Jason -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Wednesday, December 03, 2003 8:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SpamDomains Everything is already excluded from the spamdomains test except that which you specifically included. So I'm not sure I understand what you're asking for here? Bill ----- Original Message ----- From: "Jason Newland" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Wednesday, December 03, 2003 5:29 PM Subject: Re: [Declude.JunkMail] SpamDomains > I don't know how hard it would be, but what about just adding in a > "pre" filter in the spamdomains test that will bypass the test. Like: > > > Spamdomains.txt: > > [RDNS excluded from check] > > ebay.com > greetingcardvendor.com > > > [includes] > .yahoo.com > @msn.com > etc, etc > > > This would also allow us to build our list of acceptable excluded addresses together, further improving the tests accuracy. > > > Jason > > > > ---------- Original Message ---------------------------------- > From: Matthew Bramble <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Wed, 03 Dec 2003 19:38:18 -0500 > > >Alejandro, > > > > From the Declude JunkMail manual page: > > > > "This test will catch E-mail that is not coming from a mailserver > > that it should be coming from. This test will only work if you set > > up a file listing domains that you wish to be included in this test. > > Specifically, it will check the return address of the E-mail, and > > then check to see if the reverse DNS entry of the IP that the E-mail > > was sent from contains the domain name. If not, the E-mail fails the > > test. For example, if "hotmail.com" is listed in the > > \IMail\Declude\spamdomains.txt file, then an E-mail coming from > > "law2.hotmail.com" would not fail the test, but an E-mail from > > "mail.example.ru" would fail the test." > > > >You can search the archives for some discussions of this. It's > >hardly foolproof, things like greeting cards and send-a-link sites > >will often fail the test because they send E-mail with a MAILFROM > >address of the person sending the note and not the service sending > >the note. I suggest that you always use the @ symbol in the first > >column, and you should set up two different files and score them > >differently. One should be for ISP's and E-mail providers such as > >AOL, HotMail, Yahoo, etc., and the other should be for businesses > >that are often spoofed such as Microsoft, PayPal, Symantec/Norton, > >McAfee. Be careful not to include companies that may use thrid-party > >mass mailers for newsletters. The second type of test can be scored > >higher because you are less likely to be getting greeting cards from > >people with real addresses at these companies than you are from > >places like AOL. > > > >You might also be thinking of including your own domains in this > >test, but that again should be in a totally different file, and > >scored very low because even if you are using WHITELIST AUTH > >functionality, you will most definitely get users sending E-mail with > >your hosted addresses configured in their E-mail program but are > >using someone else's mail server, or without WHITELIST AUTH, they > >will fail when using your own mail server. > > > >Matt > > > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type > "unsubscribe Declude.JunkMail". The archives can be found at > http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
