BTW, if you add MSN to your file with an @ symbol, you absolutely must have two columns, not just one. @'s require two columns always.
@msn.com .hotmail.
I've been leaving off the TLD from the second column just in case they ever switch between a .com and .net address, or maybe a ccTLD. I do not believe that MSN sends from reverse DNS entries that are from msn.com. Here's what I'm using currently, however I don't claim by any means that this is anywhere near as complete as I would like it to be. I need to do more work especially at filling in the broadband providers. Also note that this is supposed to be the ISP and free E-mail version of the file and not the corporate version which should be scored higher (amazon.com, microsoft.com, symantec.com, etc.).
Matt
@yahoo. .yahoo.
@yahoo-inc.com .yahoo.
@hotmail.com .hotmail.
@msn.com .hotmail.
@aol.com .aol.
@earthlink.com .earthlink.
@cox.net .cox.
@t-online. .t-online.
@t-dialin.net .t-online.
@wanadoo.fr .wanadoo.
@netscape.net .aol.
@netscape.com .aol.
@att.net .att. @att.com .att.
@attbi.com .attbi.
@bellsouth.net .bellsouth.
@charter.net .charter.
@juno.com .untd.
@verizon.net .verizon.
@verizon.com .verizon.
@cgocable.ca .cgocable.
@rr.com .rr.com @bham.rr.com .rr.com @midsouth.rr.com .rr.com @bak.rr.com .rr.com @san.rr.com .rr.com @socal.rr.com .rr.com @hawaii.rr.com .rr.com @indy.rr.com .rr.com @midsouth.rr.com .rr.com @triad.rr.com .rr.com @sc.rr.com .rr.com @midsouth.rr.com .rr.com @stx.rr.com .rr.com @elp.rr.com .rr.com @satx.rr.com .rr.com @hot.rr.com .rr.com @new.rr.com .rr.com @sw.rr.com .rr.com @dc.rr.com .rr.com @hawaii.rr.com .rr.com @kc.rr.com .rr.com @nycap.rr.com .rr.com @rochester.rr.com .rr.com @neb.rr.com .rr.com @twcny.rr.com .rr.com @cfl.rr.com .rr.com @swfla.rr.com .rr.com @nyroc.rr.com .rr.com @tampabay.rr.com .rr.com @austin.rr.com .rr.com @carolina.rr.com .rr.com
@outblaze.com .outblaze. @2die4.com .outblaze. @accountant.com .outblaze. @adexec.com .outblaze. @africamail.com .outblaze. @allergist.com .outblaze. @alumnidirector.com .outblaze. @archaeologist.com .outblaze. @arcticmail.com .outblaze. @artlover.com .outblaze. @asia.com .outblaze. @australiamail.com .outblaze. @berlin.com .outblaze. @bikerider.com .outblaze. @catlover.com .outblaze. @cheerful.com .outblaze. @chemist.com .outblaze. @clerk.com .outblaze. @cliffhanger.com .outblaze. @columnist.com .outblaze. @comic.com .outblaze. @consultant.com .outblaze. @consultant.com .outblaze. @counsellor.com .outblaze. @cutey.com .outblaze. @deliveryman.com .outblaze. @diplomats.com .outblaze. @doctor.com .outblaze. @doglover.com .outblaze. @dr.com .outblaze. @dublin.com .outblaze. @earthling.net .outblaze. @email.com .outblaze. @engineer.com .outblaze. @europe.com .outblaze. @europe.com .outblaze. @execs.com .outblaze. @financier.com .outblaze. @gardener.com .outblaze. @geologist.com .outblaze. @graphic-designer.com .outblaze. @hairdresser.net .outblaze. @hot-shot.com .outblaze. @iname.com .outblaze. @inorbit.com .outblaze. @insurer.com .outblaze. @japan.com .outblaze. @journalist.com .outblaze. @lawyer.com .outblaze. @legislator.com .outblaze. @lobbyist.com .outblaze. @london.com .outblaze. @loveable.com .outblaze. @mad.scientist.com .outblaze. @madrid.com .outblaze. @mail.com .outblaze. @mindless.com .outblaze. @minister.com .outblaze. @moscowmail.com .outblaze. @munich.com .outblaze. @musician.org .outblaze. @myself.com .outblaze. @nycmail.com .outblaze. @optician.com .outblaze. @paris.com .outblaze. @pediatrician.com .outblaze. @playful.com .outblaze. @poetic.com .outblaze. @popstar.com .outblaze. @post.com .outblaze. @presidency.com .outblaze. @priest.com .outblaze. @programmer.net .outblaze. @publicist.com .outblaze. @realtyagent.com .outblaze. @registerednurses.com .outblaze. @repairman.com .outblaze. @representative.com .outblaze. @rescueteam.com .outblaze. @rome.com .outblaze. @saintly.com .outblaze. @samerica.com .outblaze. @sanfranmail.com .outblaze. @scientist.com .outblaze. @seductive.com .outblaze. @singapore.com .outblaze. @sociologist.com .outblaze. @soon.com .outblaze. @teacher.com .outblaze. @techie.com .outblaze. @techie.com .outblaze. @technologist.com .outblaze. @tokyo.com .outblaze. @umpire.com .outblaze. @usa.com .outblaze. @usa.com .outblaze. @whoever.com .outblaze. @winning.com .outblaze. @witty.com .outblaze. @writeme.com .outblaze. @yours.com .outblaze.
Jason wrote:
Say for example I have 10,000 people using MSN.com addresses to spam me with.
I add the spamdomains test and enter in @msn.com into it.
Now it does well to stop the spammers, but now I am falsely tagging mail from ebay.com [EMAIL PROTECTED] making a bid inquiry.
If we could have a spamdomains RDNS whitelist, then anything with a .ebay.com address is whitelisted, or whatever we put in the list.
I know we can whitelist in the main .cfg file, but I'm not sure I would want to whitelist ebay from every test, just whitelist from the spamdomains test.
Jason
-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Bill Landry Sent: Wednesday, December 03, 2003 8:20 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] SpamDomains
Everything is already excluded from the spamdomains test except that which you specifically included. So I'm not sure I understand what you're asking for here?
Bill
----- Original Message ----- From: "Jason Newland" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, December 03, 2003 5:29 PM
Subject: Re: [Declude.JunkMail] SpamDomains
I don't know how hard it would be, but what about just adding in a "pre"filter in the spamdomains test that will bypass the test. Like:
Spamdomains.txt:addresses together, further improving the tests accuracy.
[RDNS excluded from check]
ebay.com greetingcardvendor.com
[includes] .yahoo.com @msn.com etc, etc
This would also allow us to build our list of acceptable excluded
Jasonset
---------- Original Message ---------------------------------- From: Matthew Bramble <[EMAIL PROTECTED]> Reply-To: [EMAIL PROTECTED] Date: Wed, 03 Dec 2003 19:38:18 -0500
Alejandro,
From the Declude JunkMail manual page:
"This test will catch E-mail that is not coming from a mailserver
that it should be coming from. This test will only work if you
test.up a file listing domains that you wish to be included in this
Specifically, it will check the return address of the E-mail, and
then check to see if the reverse DNS entry of the IP that the
thewas sent from contains the domain name. If not, the E-mail fails
test. For example, if "hotmail.com" is listed in the \IMail\Declude\spamdomains.txt file, then an E-mail coming from "law2.hotmail.com" would not fail the test, but an E-mail from "mail.example.ru" would fail the test."
You can search the archives for some discussions of this. It's hardly foolproof, things like greeting cards and send-a-link sites will often fail the test because they send E-mail with a MAILFROM address of the person sending the note and not the service sending the note. I suggest that you always use the @ symbol in the first column, and you should set up two different files and score them differently. One should be for ISP's and E-mail providers such as AOL, HotMail, Yahoo, etc., and the other should be for businesses that are often spoofed such as Microsoft, PayPal, Symantec/Norton, McAfee. Be careful not to include companies that may use thrid-party
mass mailers for newsletters. The second type of test can be scored higher because you are less likely to be getting greeting cards from people with real addresses at these companies than you are from places like AOL.
You might also be thinking of including your own domains in this test, but that again should be in a totally different file, and scored very low because even if you are using WHITELIST AUTH functionality, you will most definitely get users sending E-mail with
your hosted addresses configured in their E-mail program but are using someone else's mail server, or without WHITELIST AUTH, they will fail when using your own mail server.
Matt
--- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
--- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
