I don't know how many NDRs caused from Email-worms are comming in on other Mail servers but here I can see far more then "normal" spam that is delivered to the recipients mailbox. So at the moment I consider this a bigger problem then spam.
The only idea I have at the moment is to introduce combined tests, that allwos use to search for appearences of multiple BODY phrases and maybe also MAILFROM. (For example see attached and zipped file.) None of this filter entries or entire filter files should be able to block a message but if it would be possible to define combined tests like BLOCK_WORM_NDR FILTER_POSTMASTER and FILTER_FAILED and (FILTER_SUBJECTS or FILTER_ATTACHMENTS) then we could set an action BLOCK_WORM_NDR HOLD and so - I guess - filter out most of this annoying NDRs. This days our customers are calling us because they receive dozens and hundreds of NDRs, and not because they dont want spam. Pleeeeeaaaaaaseeeeee :-) Markus
<<attachment: NDR_filters.zip>>
