Here is 2 good reason to use NOBODY alias . 1) IMAIL server does not have a TARPITTING or DYNAMIC IP BLOCKING feature. So it is a real heaven for Harvesters trying to find your real users. In my logs i see a lot of connection like this. Mailfrom: [EMAIL PROTECTED] rcpt to: [EMAIL PROTECTED] rcpt to: [EMAIL PROTECTED] rcpt to: [EMAIL PROTECTED] rcpt to: [EMAIL PROTECTED] rcpt to: [EMAIL PROTECTED] You can not find the line DATA in your log because the spammer is just checking the users.
2) Fake mails return address. If people start using your domain name to make some spam. Every bounce will come back to your server . And because there is no such a user in your domain the mail will get rejected at SMTPD level. The remote dumb server will try again and again wasting your bandwith and processor. A lot of dumb server will try 10 times to deliver the mail. When Nobody alias is ACTIVE 1) The harvester will see OK for every mail address For nonexisting users and also existing user. The spammer will never be able to make a database of your real users. 2) When you start accepting mail for nonexisting users . The bounced mail from the spammer will get in once , and the dumb remote server wont make many retry attempts. I just saw the bandwith going down at time i activated the nobody alias. When IMAIL will integrate a TARPITTING feature , i will turn off the NOBODY alias IN fact i will turn off the nobody alias soon , i have a software which will analyse the log of imail for many unknown rcpt from a single ip then block it on the firewall. If you have around 100 to 1000 users , you can forget using nobody alias But for 10.000 users and more ,think about it , harvesters can really make a database out of your system. Regards Rifat Levis ----- Original Message ----- From: "Len Conrad" <[EMAIL PROTECTED]> To: <[EMAIL PROTECTED]> Sent: Saturday, July 19, 2003 9:52 PM Subject: Re: [IMail Forum] Kill List >"Mail Server checks the incoming message's From ><<mailto:[EMAIL PROTECTED]>[EMAIL PROTECTED]> line. When it receives mail from an >address >listed in the kill file, IMail Server returns the message: > >501 unacceptable mail address" > >Is there a way to make IMail Drop the message rather than return it? There's no msg accepted, nothing queued, and no msg returned by Imail. It's an envelope reject, in the SMTP dialog. You can't get any more "droppy" or any more efficient than that. Minimum impact on your server, and the most immediate notification to the sender (whose MTA should generate a new msg to the sender notifying of delivery failure). The problem with the "accept rejectable msg then silently drop it" tactic is that you are wasting your bandwidth on the DATA portion of the spam. Dumb. Len _____________________________________________________________________ http://MenAndMice.com/DNS-training: Seattle; London; San Jose; Wash DC IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
