Kami's example did fail the MAILFROM test. Should have looked first :)
I think this is well covered in this case, or am I mistaken???
Matt
Matt wrote:
I was actually talking about the built in technical test in Declude
that checks for a legitimate domain name, MAILFROM. I just checked and
in fact an empty domain following the @ will trigger MAILFROM, which is
good. I would imagine that the same test should detect the underscore
since these aren't registerable and there can't be any authoritative
servers for such a domain, though maybe this is a bug? I'm not sure
that Kami clarified whether or not his example failed the MAILFROM test.
I'm sure Sniffer could catch this stuff with regular expressions (or
whatever), but Declude does the verification with the same test even on
properly constructed sender domains, which is a lot more useful. If
you constructed a body filter for such a thing within Sniffer, it
couldn't be scored very high because spammers shouldn't be using links
like that because they won't work, and therefore it would be fairly
likely to be someone like me just typing it in.
Sorry for the confusion with the empty domain string, I should have
checked this first before wondering out loud.
Matt
Pete McNeil wrote:
I don't
think Mailfrom can do it because parsing is limited.
In Message Sniffer I can code
@$+\_$+\.com
...which means any underscore bounded by any number of letters between
an
@ and a dotcom.
I want to research a bit more before pulling the trigger on this but it
looks like a good rule.
I will also say that I don't remember seeing many (if any) of these in
recent history so it might be much to do over very little.
_M
At 01:48 PM 1/20/2004, you wrote:
Hi
Matt:
Mailfrom? how?
emails can contain underscore.. we
can not
filter on the domain only.. or can we?
Kami
From:
[EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED]]
On Behalf Of Matt
Sent: Tuesday, January 20, 2004 1:36 PM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail] Underscore in domain..
Kami,
That's not valid. I've also seen some from <jsmith@> which I
believe is invalid as well.
to my knowledge, domain names can only have a hyphen or alphanumeric
characters. I believe that they can't begin with a hyphen either.
They also can't be shorter than two characters except for x.com which
slipped through their system (became PayPal several years ago).
Might be a good idea to update the MAILFROM test for these.
Matt
Kami Razvan wrote:
Hi;
Can a domain name have underscore
in it?
If not then we should really be
in
a position not to accept email from domain names that are invalid...
A test that checks for such
validity would be great considering we can NOT filter on the domain
name alone.
Please_don'[EMAIL PROTECTED]
Kami
==========
X-IMAIL-SPAM-DNSBL: (SPAMCOP,51970536,127.0.0.2)
X-IMAIL-SPAM-DNSBL: (BLARS,51970536,127.1.0.1)
X-IMAIL-SPAM-VALHELO: (51970536)
X-RBL-Warning: HELOBOGUS: Domain see_below.com has no MX or A records
[0301].
X-RBL-Warning: IPNOTINMX:
X-RBL-Warning: NOLEGITCONTENT: No content unique to legitimate E-mail
detected.
X-RBL-Warning: MAILFROM: Domain see_below.com has no MX or A records
[0301].
X-RBL-Warning: COUNTRY: Message failed COUNTRY test (line 189, weight 1)
X-RBL-Warning: FILTER-HEADER-XMAIL: Message failed FILTER-HEADER-XMAIL
test (line 45, weight 20)
X-RBL-Warning: FILTER-SPAM-HTML: Message failed FILTER-SPAM-HTML test
(line 193, weight 5)
X-Declude-Sender: Please_don'[EMAIL PROTECTED]
[203.125.58.130]
X-Declude-Spoolname: D44b4031901e80924.SMD
X-Note:
==================================================================
X-Note: Spam Score: 58 [BLOCKED ON 20+ & DELETED ON 60+]
X-Note: Scan Time: 10:10:08 on 01/20/2004
X-Note: Spool File: D44b4031901e80924.SMD
X-Note: Server Name: see_below.com
X-Note: SMTP Sender: Please_don'[EMAIL PROTECTED]
X-Note: Reverse DNS & IP: bb-203-125-58-130.singnet.com.sg
[203.125.58.130]
============
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
--
=====================================================
MailPure custom filters for Declude JunkMail Pro.
http://www.mailpure.com/software/
=====================================================
|
