On Thu, Oct 16, 2008 at 09:01:02AM -0500, [EMAIL PROTECTED] wrote: > In the last hour, I've received over 200 legitimate bounce messages from > email services as a result of someone having used or worse is using my > email address in spam from multiple windows machines and ip addresses. > The end result is that I am getting the bounce messages. I'm sure that > others on this list have experienced the problem and maybe have a > solution that I don't have. > > The messages are allowed through my obspamd/pf and pf smtp bruteforce > blocking rules because they are completely legit. > > I guess the work around is to filter them on incoming together with our > local bounce messaages util the spammers get tired of my address.
The term coined for this type of mail is "backscatter". There is no easy solution for this. The backscatter article on postfix.org, for example, caused our mail servers to start rejecting mail that was generated from PHP scripts and CGIs on our own systems, which makes no sense. The article: http://www.postfix.org/BACKSCATTER_README.html If the backscatter is all directed to a single Email address (rather than a series of addresses, e.g. [EMAIL PROTECTED], and you have [EMAIL PROTECTED] accepted), then a solution is to reject mail with an RCPT TO of an account or virtual address that does not exist on your machine. This, of course, has a wonderful side effect: spammers now have a way to detect what Email addresses on your box legitimately accept mail, thus once they find one which never gets a bounceback, will start pounding that address to kingdom come. Let me know if you do find a reliable, decent solution that does not involve SPF or postfix header_checks or body_checks. -- | Jeremy Chadwick jdc at parodius.com | | Parodius Networking http://www.parodius.com/ | | UNIX Systems Administrator Mountain View, CA, USA | | Making life hard for others since 1977. PGP: 4BD6C0CB | _______________________________________________ email@example.com mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "[EMAIL PROTECTED]"