Hi Todd, Backscatter from forging spam is a serious problem, and what you are experiencing. What's happening is that a spammer has harvested your customer's email address, and is sending out spam through their zombie network forging your customer's email address.
There are two ways to combat it: 1. Use SPF on your customers domain in the hopes that mail servers receiving the spam will check SPF, see that the message was forging spam, and not bounce back to you. This has limited success. If the receiving server had good filtering in place, and used proper no-bounce-on-spam procedures, you wouldn't be receiving the bounces anyway. 2. Filter on any information you can find within the email, like the original spammy subject, in order to push the bounces into review or delete range. This is also limited to responding to particular spammy subjects or constant forging with wrong names, and is very reactive and temporary. I have another idea that I'm discussing on another list right now to combat this in a more proactive manner. I'll report back if any progress is made towards implementing a filter. Darin. ----- Original Message ----- From: Todd Richards To: [email protected] Sent: Saturday, December 02, 2006 12:20 PM Subject: [IMail Forum] New user problem Hi Everyone - I'm not sure where this post belongs, so I will post here first. We took on hosting for one of our members mid-week last week, and there is a problem going on. Before the changeover, they complained that one of the users, in particular, was getting a TON of spam with their old host. I proudly said "no problem" as we have things clicking very nicely now with our setup. Well, the switch has been made and said user does not get the spam he was getting before. However, I'm seeing it in that Declude/Sniffer/etc is catching it. The stuff he was referring to as "spam" is bounced messages from other people. Either his email address has been hi-jacked, or his computer has as the bounced messages are coming in that say the message from "Wrong Name <[EMAIL PROTECTED]>" could not be delivered. The trail after that shows that they are definitely spam. I have been looking through the logs and can't see for sure that the originating message is coming through our server (I haven't spent hours looking at the logs). So I can't say for sure that he is sending it through us. But I'm worried about ending up blacklisted for sending this crap. I have asked the end-users to thoroughly scan his computer for problems, and fix if found. There is no on-site tech, so they asked about changing the email address. While I'm not opposed, if it is in fact his computer then that won't make much difference. Am I missing anything? Is there any better way to troubleshoot that you can think of? None of the other users on his domain are seeing this, and I have not seen this type of traffic from any of the other users we host mail for. For what it's worth we are using Imail 8.22 (with ALL patches), the latest version of Declude, Sniffer, and invURIBL 2.7 - all running on Windows 2003 Server. I appreciate any thoughts or direction on this. Thanks! Todd [EMAIL PROTECTED]
