Kjetil Torgrim Homme wrote: > On Tue, 2008-11-11 at 12:40 +0000, Adam Stephens wrote: > >> Kjetil Torgrim Homme wrote: >> >>> On Mon, 2008-11-10 at 17:52 +0000, Adam Stephens wrote: >>> >>>> I certainly wouldn't block on it outright like this. We see forwarded >>>> mail with hotmail senders, and mailing list mail, and mail from ebay's >>>> mail servers, and apparently legitimate mail sent via other ISPs, all of >>>> which would be rejected by this rule. >>>> >>> the test checks the envelope sender, not the headers of the e-mail. you >>> won't get false positives from mailing lists, forwarded e-mail or eBay >>> with that rule. >>> >> My logs say otherwise. >> > > without log excerpts, I'm not inclined to believe you. > Suit yourself.
Here's one from ebay: 2008-11-11 13:49:05 1Kztc3-0004Mi-0G <= [EMAIL PROTECTED] H=mxpool22.ebay.com (mxpool01.ebay.com) [66.135.197.28] P=esmtp S=17965 [EMAIL PROTECTED] from <[EMAIL PROTECTED]> for [EMAIL PROTECTED] Here's a forwarded mail: 2008-11-10 16:43:08 1KzZqp-0006DD-TV <= [EMAIL PROTECTED] H=forward.a.hostedemail.com [216.40.42.17] P=esmtp S=37233 [EMAIL PROTECTED] from <[EMAIL PROTECTED]> for [EMAIL PROTECTED] Here's some legitimate mail submitted via another ESP: 2008-11-08 09:22:34 1Kyk1Q-00063Y-7Y <= [EMAIL PROTECTED] H=outmail129176.authsmtp.com [62.13.129.176] P=esmtp S=12044 [EMAIL PROTECTED] from <[EMAIL PROTECTED]> for [EMAIL PROTECTED] And this one is, I'm told, a mailing list: mainlog.02.gz:2008-11-09 02:30:21 1Kz045-0004Rr-1P <= [EMAIL PROTECTED] H=yearning.mcc.ac.uk [130.88.203.23] P=esmtp S=40228 [EMAIL PROTECTED] from <[EMAIL PROTECTED]> for [EMAIL PROTECTED] [EMAIL PROTECTED] regards, Adam. -- -------------------------------- Adam Stephens Network Specialist - Email & DNS [EMAIL PROTECTED] -- ## List details at http://lists.exim.org/mailman/listinfo/exim-users ## Exim details at http://www.exim.org/ ## Please use the Wiki with this list - http://wiki.exim.org/
