[Declude.JunkMail] Gateways and CMDSPACE conundrum

[Matt]

Scott, Sandy and others that might have an idea about what do to, I've been moving towards a setup that allows me to do envelope rejection of invalid addresses for gatewayed domains due to repeated instances where spammers have dictionary attacked servers that accept all valid domains without an attempt to validate the user.  I have setup a gateway to use MS SMTP with VAMSoft's ORF which allows me to blacklist all addresses but those that match the list I provide it.  I have unfortunately noticed though that the CMDSPACE dependencies (a space in the RCPT TO command) are not preserved when passing through the gateway.  The conundrum that I face is the conflict between the following two requirements/wishes: 1) SMTP Envelope Rejection of Invalid Addresses - This is a requirement from what I can determine on any gateway spam filtering solution.  This protects from haphazard dictionary attack harvesting of invalid addresses, blocks problematic Joe-Jobs, avoids scanning of dead and undeliverable gatewayed accounts which can result in bounce messages to forged addresses when such messages pass the spam filtering mechanism and are sent to the destination server. 2) CMDSPACE Detection - Given that this test will hit on about 50% of the spam that our system sees, and is about 99.9% accurate on our system, it would be very unfortunate to loose the ability to detect this condition when handled by a gateway designed to provide the ability to do SMTP Envelope Rejection.  In the very least, it appears that MS SMTP reformats the RCPT TO command and eliminates the space.  I imagine that it is also possible that the gateway is also capable of modifying broken headers that may trip BADHEADERS or SPAMHEADERS, though I haven't verified this. I'm not yet married to one particular solution for either need.  I'm sure that there are other solutions out there besides ORF that can be used to do envelope rejection of invalid senders on gatewayed domains, and if it was possible to modify the headers at the gateway to indicate the improper RCPT TO space, this could then be detected through a custom filter in Declude.  I would like to avoid if possible a setup that would require a different server to handle the envelope rejection, though the cost of a box running Linux plus hosting may be worth it if I can preserve the RCPT TO and other header formatting. I've noted in the ORF logs that the space is shown when present, just not replicated.  My plan was to place both MS SMTP with ORF on the same server as IMail with Declude, and I'm thinking that it may also be possible to parse the logs in real-time in order to retrieve this information through an external test in Declude.  ORF supports syslogging or logging to a text file which isn't locked.  If this is reasonable to do, i.e. not processor intensive or overly convoluted , I could get someone to program it for me.  While this might solve the problem in the setup that I've been considering, it doesn't resolve the issue for others using gateways that strip this information. I'm hoping that maybe someone here has some ideas about which technologies could be used to do both envelope rejection of invalid gatewayed addresses, and either maintain the RCPT TO command formatting, modify the headers to indicate the condition, or possibly a way to approach this through a separate app that is exposed to the ORF logs. BTW Scott, I'd pay extra for an implementation of Declude not dependent upon IMail for functionality.  Although there are many other spam blocking products out there that will do this, none of them are created and supported by someone with the degree of experience that you have nor the level of understanding.  To people like myself this would represent a very nice savings on hardware, software and hosting costs. Thanks, Matt -- ===================================================== MailPure custom filters for Declude JunkMail Pro. http://www.mailpure.com/software/ =====================================================