the vast majority of spam has a forged envelope sender that is eitherSome thoughts about dictionary attacks and using the "nobody" alias (sorry if this duplicates earlier suggestions by other members):The "nobody" alias could have an auto-reply or vacation message so that [your] bandwidth wasted by the spammers results in [their] bandwidth being wasted as they get a reply for each invalid address that they test.
1) [EMAIL PROTECTED]
2) [EMAIL PROTECTED]
3) [EMAIL PROTECTED]
4) <> (null sender)
tracking to attack the above senders' MX's is useless, and punitive for known.domain's who are not the real attacker.
Just looking at the Imail rejects is enough to harvest the ip's of the attackers. no need to waste your bandwidth with a nobody alias.Using a vacation message also yields a list of spamming senders' addresses who sent probes to non-existent addresses on your server.
The only possibly effective counter-attack is to attack the ip sending the attack, but ime, these ip's are often not listening on port 25, or if they do listen, it's a nobody-type of blackhole.
Counter-attacks are a total waste of time.
Len
To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
