No Postfix, but something I may think about.

I've been meaning to for a while, but it seems I really need to upgrade to
Pro, huh? <grin>

Darin.


----- Original Message ----- 
From: "Bill Landry" <[EMAIL PROTECTED]>
To: <[EMAIL PROTECTED]>
Sent: Wednesday, October 20, 2004 9:21 PM
Subject: Re: [Declude.JunkMail] Random Helo strings


----- Original Message ----- 
From: "Darin Cox" <[EMAIL PROTECTED]>


> I guess my rules aren't quite to the point where I can clearly separate
the
> legit mail with bogus HELOs from the spam....without relying on other
tests
> in a weighting system.  That's why it wouldn't work for me to block on
this
> alone.
>
> Perhaps you have some better rules in place that some of us are not
familiar
> with and could utilize?

If you are running a Postfix gateway in front of your IMail/Declude server,
I can certainly help you out, and would be will to do so.

> For example, I just saw one tonight that forged one of our domains as the
> HELO, but didn't get detected.  I thought there was a test to check the
HELO
> against the Reverse DNS?

Here are a couple of examples of how you can block these with Declude
JunkMail Pro:

In a filter file:
HELO 10 ENDSWITH your.hostname.com
HELO 10 IS xxx.xxx.xxx.xxx  <=== your IP address

Another way is to add weight for e-mail message that claim to be from one of
your domains ([EMAIL PROTECTED]).

In a spamdomain file:
@example1.com    .example1.com
@example2.com    .example1.com

Anyway, keep up the good fight!

Bill

---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

---
This E-mail came from the Declude.JunkMail mailing list.  To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail".  The archives can be found
at http://www.mail-archive.com.

Reply via email to