We've been getting upwards of 30k messages a day which are NDR's with our domain name, but with a randomly generated username. We found that although our mail server is more then capable of handling the volume, it was creating a lot of lag with POP3 accounts when the server was being hammered with the dang things. Seems this is getting to be the latest craze, spamming with legit domain names attached to a random username.
So what we did was to set up two BSD/Postfix boxes that filter based on a list of our valid users which we update as needed. The incoming NDR's are then trashed at the BSD/Postfix level and Imail and Declude don't have to deal with them. This is kind of like Len Conrads Imgate, but it only checks for a valid username before relaying the email into the Imail box. Rich ----- Original Message ----- From: "declude" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Friday, June 11, 2004 4:05 AM Subject: Possible Spam: RE: [Declude.JunkMail] NDR's > Markus > > We are seeing 1 in 10 email's which are NDR's and are nothing to do with the german-politic spam messages. > > Look's like we have a new problem, which is growing quickly. > > Scott I hope you can help on this one or anyone else... > > Kevin > > > ---------- Original Message ---------------------------------- > From: "Markus Gufler" <[EMAIL PROTECTED]> > Reply-To: [EMAIL PROTECTED] > Date: Fri, 11 Jun 2004 12:49:55 +0200 > > > > >> We are seeing a lot of NDR's coming from ligit servers, with > >> a spoofed user name, but a correct domain name. > >> > >> What would be the best way to deal with this ever growing problem. > > > >Yipiieee :-) > >I'm not the only one having this problem. > > > >As I can see this are NDR's from current spam messages having forged but > >real existing mailfrom addresses and a lot of random recipient names in > >combination with valid domains. (german-politic spam messages send from > >sober.g zombies) > > > >Markus > > > > > >--- > >[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > > >--- > >This E-mail came from the Declude.JunkMail mailing list. To > >unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > >type "unsubscribe Declude.JunkMail". The archives can be found > >at http://www.mail-archive.com. > > > > > >[ PS. This email has been securely processed by Sorting Office ] > > > > > > > __________________________________________________________________ > This email has been Processed using Sorting Office Email Services > This email and any attachments are confidential to the intended > recipient and may also be privileged. If you are not the intended > recipient please delete it from your system and notify the sender. > You should not copy it or use it for any purpose nor disclose or > distribute its contents to any other person. > > Sorting Office Email Filter Solution > Anti-Virus | Anti-Spam > For kad.co.uk > --- > [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] > > --- > This E-mail came from the Declude.JunkMail mailing list. To > unsubscribe, just send an E-mail to [EMAIL PROTECTED], and > type "unsubscribe Declude.JunkMail". The archives can be found > at http://www.mail-archive.com. > --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
