On Sun, Jul 20, 2003 at 01:37:15PM -0500, Kevin Kinsey, DaleCo, S.P. wrote:
> I'm not happy that Sendmail is
> allowing connections from non-
> existent hosts (i.e., spammers...)
> I run Sendmail more or less straight
> "out of the box" on -stable.  I had
> been under the impression that the
> line
> ALL : PARANOID : RFC931 20 : deny
> in /etc/hosts.allow would help reject
> some of this stuff.  However, as the
> amount of spam in my inbox is
> beginning to attest, this isn't the case.
> I've been googling and searching the 
> archives with strings similar to the
> one in the title, and haven't yet grok
> what I'm supposed to do to get this
> to work...
> So, how do I tell Sendmail that if
> a host doesn't exist, (i.e. d3kr890d.129ddk.org)
> I don't want to talk to it...

The way that sendmail(8) uses tcp wrappers is slightly different to
most daemons.  Instead of outright refusing to connect (which would
lead to the other side trying again every half hour or so for the next
five days), it permits the remote side to connect and then issues a
permanent reject code during the SMTP dialogue.

Even without enabling tcp wrappers functionality, sendmail should
still reject egregiously forged addresses.  You have to add


to your `hostname`.mc file to allow incoming mail from domains without
either A or MX records registered in the DNS.

I find that the DNSBL feature is rather effective at rejecting spam
e-mail.  Generally my mailserver gets about 20--30 spam e-mails a
day. Of those, all but 2 or 3 are rejected by the DNSBL, and the rest
are taken out by spamassassin, with perhaps 2 false negatives a week
and no false positives.

I find that the combination of these three blacklists is most effective:

    FEATURE(dnsbl, `bl.spamcop.net', `"550 Mail from " $&{client_addr} " rejected 
using spamcop.net DNSBL. See http://spamcop.net/w3m?action=checkblock&ip="; 
$&{client_addr}', `')dnl
    FEATURE(dnsbl, `relays.osirusoft.com', `"550 Mail from " $&{client_addr} " 
rejected using relays.osirusoft.com DNSBL. See http://relays.osirusoft.com/";', `')dnl
    FEATURE(`dnsbl', `blackholes.easynet.nl', `"550 5.7.1 ACCESS DENIED to 
"$&{client_name}" by easynet.nl DNSBL (http://blackholes.easynet.nl/errors.html)"', 



Dr Matthew J Seaman MA, D.Phil.                       26 The Paddocks
                                                      Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey         Marlow
Tel: +44 1628 476614                                  Bucks., SL7 1TH UK

Attachment: pgp00000.pgp
Description: PGP signature

Reply via email to