Thanks for the input Sandy, basically you just reinforced what I believed to be true anyway. I guess the "powers that be" here are ok with the 1-2% legitimate lost mail that this rule causes, so it will stay that way, but thanks again for the input.
-HJ -----Original Message----- From: Sanford Whiteman [mailto:[EMAIL PROTECTED] Sent: Friday, April 09, 2004 2:30 AM To: Herschel Jones (Industries - Augusta) Subject: Re: [IMail Forum] Rules and x-rcpt-to > The naming convention is [EMAIL PROTECTED] and we want to make > sure that nothing gets to Exchange that isn't to an address of that > naming convention...These forum messages for example, get picked off > by that rule, because the from is [EMAIL PROTECTED] and > the to address is [EMAIL PROTECTED] same holds > true for any message in which my user name is in the BCC field of > the envelope. If you study how SMTP works, you'll realize that your test is unworkable. All you've "discovered" is that legitimate message data need not include information from the message envelope (the latter being what is used to actually transmit mail from client to server to server). You can't make that fact go away. > This rule in itself actually catches more "accurate" spam than the > anti-spam filters... The only reason this _seems_ true is that (a) a large amount of spam is sent using envelope sending alone, and (b) a small--yet non-negligible--amount of legitimate traffic sent to your site is sent using the same method. It is, in fact, a highly inaccurate test in the general sense. You are lucky to be affected to a relatively small degree--picture sites that do large traffic in business-critical bulk dispatches, distribution lists, et al. > ...so removing the rule is not a very viable option. I disagree. You're going to have to find a way to fight spam that works (or that works without impossibly frequent whitelist maintenance). It's a notable disservice to your users to silently drop legitimate Bcc: mail, for one example. > I have spoken with, in my opinion, one of the most knowledgeable > techs at Ipswitch and we came to the decision that this could not be > done to a good degree of accuracy. No kidding! I hope that call didn't last too long. :) --Sandy ------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED] SpamAssassin plugs into Declude! http://www.mailmage.com/download/software/freeutils/SPAMC32/Release/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
