That sounds pretty dumb. Why not just turn off the part of the test (verify mail from) that does not work very good for you? Or better yet adjust your filtering so that this does not occur.

We are using the IMail spam tests and are generally pleased with the result and I cannot think of a situation in which our filters would result in the type of false positive deletion of mail that you are describing. To see an updated flow chart and detailed description of the tests that we use and the results that we are returning see:

http://www.summitinternetservices.com/tests.htm

At 09:12 AM 12/22/2004, you wrote:
We were using I-Mails spam blocker and decided to turn it off.  The issue
that we were having is that some of the AOL and overseas e-mail users were
unable to send us e-mail.  This resulted in a couple of e-mails being lost.
It wasn't a result of I-mail but the fact that the senders host was unable
to verify the e-mail address.  That made it SPAM.

Now we just have the SPAM come in with the subject reading Possible Spam -
and then the reason why.

Chuck


-----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Wednesday, December 22, 2004 12:00 AM Subject: [IMail_Forum DIGEST]

----------------------------------------------------------------------

From: <[EMAIL PROTECTED]>
Subject: RE: [IMail Forum] Anti-Spam
Date: Tue, 21 Dec 2004 13:52:39 +0100
Reply-To: [email protected]
Brad,

Try XWall. It works as SMTP-relay with any type of SMTP server.
See http://www.xwall.us.

Marius

-----Original Message-----
From: [EMAIL PROTECTED]
[mailto:[EMAIL PROTECTED] Behalf Of Brad Lusk
Sent: Wednesday, December 15, 2004 11:31 PM
To: IMail_Forum
Subject: [IMail Forum] Anti-Spam

Can anyone recommend a spam-blocker that they're actually satisfied with?
I've been using Imails word and phrase list with luck for a while but it
seems that the spammers have been working much harder lately...
----------------------------------------------------------------------

From: "Tom Pepper" <[EMAIL PROTECTED]>
Subject: [IMail Forum] spamcop.net rbl
Date: Tue, 21 Dec 2004 07:41:17 -0600
Reply-To: [email protected]
We are using bl.spamcop.net in our anti-spam rbl.  However, the messages are
not actually being deleted.  They continue to com through.

The spam log, for example, shows:
BLACKLIST: xx.xx.xxx.xx was found on blacklist spamcopy: *:bl.spamcop.net ->
Blocked - see http://www.spamcop.net/bl.shtml?xx.xx.xxx.xx
failed 1 lf 14 checks - deleting.

Why is it not actually deleting?  Thanks!

Tom


----------------------------------------------------------------------

From: "E. Shanbrom \(Ipswitch\)" <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists
Date: Tue, 21 Dec 2004 12:44:32 -0500
Reply-To: [email protected]
You could set up the list as subscribers only and use the posters list for
those who are not subscribers OR you could set up a rule on each list
looking for the From field to have your domain in it...The 2nd method is
still spoofable tho.

Eric S
----- Original Message -----
From: "Alan Walters" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Monday, December 20, 2004 9:48 PM
Subject: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists


> Hi Eric, > > Thanks for the reply, but if I understand correctly what that would do, then > only subscribers could send email to that list? > > IOW, if I wasn't a member of a given list I couldn't send email to it? I'm > not sure that would work for us. We have several distribution lists here, > roughly one per department. If somebody in the A/R dept. wants to send an > email to everybody in the A/P dept. they can use the A/R dept. list. They > probably wouldn't be a subscriber to a list from a different dept. > > What is the point of AUTH'ing and the log message "Authenticated > [EMAIL PROTECTED], session treated as local."? If the sessions were > truly treated as local then I'd think that would solve the problem. > Instead, despite the log message to the contrary, the user sessions are > treated as remote. > > Alan Walters > Director of I.T. > Royce Medical > > P.S. > Sorry for the long delay in getting back, this has been a week from hell... > > > > From: "E. Shanbrom \(Ipswitch\)" <[EMAIL PROTECTED]> > > Subject: Re: [IMail Forum] Stopping REMOTE users from accessing > > LOCAL Lists > > Date: Thu, 16 Dec 2004 17:40:52 -0500 > > Reply-To: [email protected] > > Have you thought of setting the lists to subscribers only? > > > > Eric S > > ----- Original Message ----- > > From: "Alan Walters" <[EMAIL PROTECTED]> > > To: "[EMAIL PROTECTED] Ipswitch. Com" <[email protected]> > > Sent: Thursday, December 16, 2004 2:24 PM > > Subject: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists > > > > > We've recently had a surge in SPAM targeting our global All-Users List. > We > > > still need internal users to be able to access any Distribution List, > while > > > denying external senders. Thinking that's what the "Allow Remote Mail > to > > > Local Groups" checkbox was for, I unchecked it (and restarted the SMTP > > > service). Suddenly, internal users couldn't access any of the Lists. > > > > > > All internal users AUTH so I assumed they would be considered LOCAL (and > > > allowed), while external senders would be considered REMOTE (and > denied). > > > The Log even shows "Authenticated [EMAIL PROTECTED], session treated > as > > > local." for every internal user who attempts to send: > > > > > > 12:16 09:15 SMTPD(00050394) [192.168.100.6] connect 192.168.101.112 port > 1148 > > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] EHLO roycemedical.com > > > 12:16 09:15 SMTPD(00000554) Authenticated > [EMAIL PROTECTED], session treated as local. > > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] MAIL > FROM:<[EMAIL PROTECTED]> > > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] RCPT > TO:<[EMAIL PROTECTED]> > > > 12:16 09:15 SMTPD(00050394) denied remote access to > C:\IMAIL\Groups\Daily-Sales.txt (roycemedical.com) > > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] ERR roycemedical.com > invalid user <[EMAIL PROTECTED] > > > > > > Is there a way to allow local users access to Distribution Lists, but > deny > > > them to non-local senders? > > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ >

----------------------------------------------------------------------

From: "A. Clausen" <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] Separate SMTP Server - Slightly OT?
Date: Tue, 21 Dec 2004 09:49:56 -0800
Reply-To: [email protected]

----- Original Message -----
From: "David" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Sunday, December 19, 2004 12:42
Subject: Re: [IMail Forum] Separate SMTP Server - Slightly OT?


> Len wrote: > > By using a separate box as defensive MX, you will reduce dramatically the > > number of IMail SMTP connections wasted on spam, allowing more sessions > for > > legit SMTP AUTH sessions. > > Thanks Len. We have a Barracuda Spam Firewall in front of the iMail server, > and it is doing a great job of blocking spam from hitting the iMail server. > We need a way or separate SMTP Server to use for clients' SMTP Server in > their email client when these connection problems occur though. At least > until either iMail can better handle the number of connections. As our user > base grows we will still hit this limit eventually.

Have you looked at your activity logs?  What is generating all this traffic.
Unless you are running a very high volume site, 50 or 55 simultaneous
connections for legitimate traffic really isn't that bad.  Do you still have
an MX record for your IMail box.  We put up a Postfix box with Len Conrad's
IMGate configs earlier this year, and then removed the IMail server's MX
record entirely.  As far as the rest of the planet is concerned, only the
Postfix box is a mail server.  Otherwise, it's quite possible that worms and
such are still bogging down your machine even if you some sort of anti-spam
server sitting there.

--
A. Clausen

----------------------------------------------------------------------

From: "A. Clausen" <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] Separate SMTP Server - Slightly OT?
Date: Tue, 21 Dec 2004 09:50:43 -0800
Reply-To: [email protected]

----- Original Message -----
From: "Sanford Whiteman" <[EMAIL PROTECTED]>
To: "David" <[email protected]>
Sent: Sunday, December 19, 2004 20:31
Subject: Re: [IMail Forum] Separate SMTP Server - Slightly OT?


> > I've read in the archives that it can be done with the Microsoft > > SMTP Server that's included in IIS. . . > > Yep, that was probably my note. > > > but I can't see how to import all the users/passwords. It appears > > like all the users would have to be created as Windows users. Does > > anyone know how to synchronize the users with iMail? > > Give me 2 days--this is my next free script, intended both for the > purpose you describe and to enable port 587 auth-only support on the > mailbox server itself. > > Are you using the default (Registry) database, or an ODBC datasource?

Isn't it possible to write a separate authentication module for MS-SMTP?

--
A. Clausen
----------------------------------------------------------------------

From: "Kevin Bilbee" <[EMAIL PROTECTED]>
Subject: RE: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists
Date: Tue, 21 Dec 2004 09:53:30 -0800
Reply-To: [email protected]
The best way to handle this is to create a new domain on your server with a
non resolvable domain name like example.local then create all of your lists
under this domain name. then you could open the list so anyone could send to
the list. What this will do is make the lists available to all hosts that
can relay through your server, Authed users.


We use this technique. The only issue we have with it is if there is a user on the list without a local account then they will not be able ot reply to the list.


Kevin Bilbee

> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] Behalf Of Alan Walters
> Sent: Monday, December 20, 2004 6:49 PM
> To: [email protected]
> Subject: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists
>
>
> Hi Eric,
>
> Thanks for the reply, but if I understand correctly what that
> would do, then
> only subscribers could send email to that list?
>
> IOW, if I wasn't a member of a given list I couldn't send email
> to it?  I'm
> not sure that would work for us.  We have several distribution lists here,
> roughly one per department.  If somebody in the A/R dept. wants to send an
> email to everybody in the A/P dept. they can use the A/R dept. list.  They
> probably wouldn't be a subscriber to a list from a different dept.
>
> What is the point of AUTH'ing and the log message "Authenticated
> [EMAIL PROTECTED], session treated as local."?  If the sessions were
> truly treated as local then I'd think that would solve the problem.
> Instead, despite the log message to the contrary, the user sessions are
> treated as remote.
>
> Alan Walters
> Director of I.T.
> Royce Medical
>
> P.S.
> Sorry for the long delay in getting back, this has been a week
> from hell...
>
>
> > From: "E. Shanbrom \(Ipswitch\)" <[EMAIL PROTECTED]>
> > Subject: Re: [IMail Forum] Stopping REMOTE users from accessing
> > LOCAL Lists
> > Date: Thu, 16 Dec 2004 17:40:52 -0500
> > Reply-To: [email protected]
> > Have you thought of setting the lists to subscribers only?
> >
> > Eric S
> > ----- Original Message -----
> > From: "Alan Walters" <[EMAIL PROTECTED]>
> > To: "[EMAIL PROTECTED] Ipswitch. Com" <[email protected]>
> > Sent: Thursday, December 16, 2004 2:24 PM
> > Subject: [IMail Forum] Stopping REMOTE users from accessing LOCAL Lists
> >
> > > We've recently had a surge in SPAM targeting our global
> All-Users List.
> We
> > > still need internal users to be able to access any Distribution List,
> while
> > > denying external senders.  Thinking that's what the "Allow Remote Mail
> to
> > > Local Groups" checkbox was for, I unchecked it (and restarted the SMTP
> > > service).  Suddenly, internal users couldn't access any of the Lists.
> > >
> > > All internal users AUTH so I assumed they would be considered
> LOCAL (and
> > > allowed), while external senders would be considered REMOTE (and
> denied).
> > > The Log even shows "Authenticated [EMAIL PROTECTED],
> session treated
> as
> > > local." for every internal user who attempts to send:
> > >
> > > 12:16 09:15 SMTPD(00050394) [192.168.100.6] connect
> 192.168.101.112 port
> 1148
> > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] EHLO roycemedical.com
> > > 12:16 09:15 SMTPD(00000554) Authenticated
> [EMAIL PROTECTED], session treated as local.
> > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] MAIL
> FROM:<[EMAIL PROTECTED]>
> > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] RCPT
> TO:<[EMAIL PROTECTED]>
> > > 12:16 09:15 SMTPD(00050394) denied remote access to
> C:\IMAIL\Groups\Daily-Sales.txt (roycemedical.com)
> > > 12:16 09:15 SMTPD(00050394) [192.168.101.112] ERR roycemedical.com
> invalid user <[EMAIL PROTECTED]
> > >
> > > Is there a way to allow local users access to Distribution Lists, but
> deny
> > > them to non-local senders?
>
>
>
> To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
> List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
> Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/
>

----------------------------------------------------------------------

Date: Tue, 21 Dec 2004 13:19:34 -0500
From: Sanford Whiteman <[EMAIL PROTECTED]>
Subject: Re[2]: [IMail Forum] Separate SMTP Server - Slightly OT?
Reply-To: [email protected]
> Isn't  it  possible  to  write  a separate authentication module for
> MS-SMTP?

No, not for MS SMTP alone; believe me, we've done much research on the
subject  in  hopes  of  writing  just  that  AUTH plug-in for an IMail
database.  There are hitches in the way SMTP event sinks are processed
(in fact, one major hitch is due to an error in the MSDN docs that has
never been updated with correct info) that make them suitable for just
about anything in the envelope _but_ SMTP AUTH transactions.

It  is  indeed possible to write alternate authentication packages for
the   Windows  platform  as  a  whole,  and  these  are  comparatively
well-documented.  but  IME  this  is some of the most advanced systems
programming around, and very difficult to code safely.

It's  also  possible,  quite simply as far as the client side goes, to
use  Kerberos from MS SMTP, but on the server side this requires a KDC
capable  of  issuing  tickets  for  credentials  from either the IMail
registry  or ODBC; since the only open-source KDC (MIT) is *nix-based,
this  would  be  mean  hacking (and running) a *nix-based KDC to use a
Windows-based datasource. This is not a drop-in solution. :)

--Sandy


------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!

http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!

http://www.mailmage.com/products/software/freeutils/exchange2aliases/downloa
d/release/

http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/re
lease/

----------------------------------------------------------------------

Date: Tue, 21 Dec 2004 14:57:23 -0500
From: "R. Scott Perry" <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] spamcop.net rbl
Reply-To: [email protected]

>The spam log, for example, shows:
>BLACKLIST: xx.xx.xxx.xx was found on blacklist spamcopy: *:bl.spamcop.net
->
>Blocked - see http://www.spamcop.net/bl.shtml?xx.xx.xxx.xx
>failed 1 lf 14 checks - deleting.
>
>Why is it not actually deleting?  Thanks!

Is that *exactly* what it said?  The grammar there is pretty bad, but "If
14 checks - deleting" suggests something like "If 14 checks, will delete"
(meaning "If the E-mail fails 14 or more spam tests, it will be deleted").

                                                    -Scott
---
Declude JunkMail: The advanced anti-spam solution for IMail mailservers
since 2000.
Declude Virus: Ultra reliable virus detection and the leader in mailserver
vulnerability detection.
Find out what you've been missing: Ask for a free 30-day evaluation.


---- This outgoing message is guaranteed to be authentic by Message Level users. Guarantee the authenticity of your email @ http://www.messagelevel.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]

----------------------------------------------------------------------

From: "Tom Pepper" <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] spamcop.net rbl
Date: Tue, 21 Dec 2004 14:21:58 -0600
Reply-To: [email protected]
Sorry for the typos.  Should be 1 "of" 14 tests.
It should have been deleted.  The spam log says it was, but the mail was in
fact delivered.  This happens quite often with spamcop on our mail server.

Thanks, Scott.

Tom
----- Original Message -----
From: "R. Scott Perry" <[EMAIL PROTECTED]>
To: <[email protected]>
Sent: Tuesday, December 21, 2004 1:57 PM
Subject: Re: [IMail Forum] spamcop.net rbl


| | >The spam log, for example, shows: | >BLACKLIST: xx.xx.xxx.xx was found on blacklist spamcopy: *:bl.spamcop.net -> | >Blocked - see http://www.spamcop.net/bl.shtml?xx.xx.xxx.xx | >failed 1 lf 14 checks - deleting. | > | >Why is it not actually deleting? Thanks! | | Is that *exactly* what it said? The grammar there is pretty bad, but "If | 14 checks - deleting" suggests something like "If 14 checks, will delete" | (meaning "If the E-mail fails 14 or more spam tests, it will be deleted"). | | -Scott | --- | Declude JunkMail: The advanced anti-spam solution for IMail mailservers | since 2000. | Declude Virus: Ultra reliable virus detection and the leader in mailserver | vulnerability detection. | Find out what you've been missing: Ask for a free 30-day evaluation. | | | ---- | This outgoing message is guaranteed to be authentic by Message Level users. | Guarantee the authenticity of your email @ http://www.messagelevel.com. | --- | [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] | | | To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html | List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ | Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/ | |


----------------------------------------------------------------------

From: "A.J. Ostman" <[EMAIL PROTECTED]>
Subject: [IMail Forum] Repeat Outgoing Email Problem
Date: Tue, 21 Dec 2004 16:28:35 -0800
Reply-To: [email protected]
Our installation of IMAIL 8.14 HF1 is doing some funky things in the last
couple weeks.

Sometimes, outgoing email is being sent to its destination 2-66 times
instead of just once, despite having a successful initial delivery! I know
this is a generic statement of the problem, but I am just curious if anyone
else has been experiencing anything similar. Local mail is not duplicated,
but outgoing email sometimes is.

Thanks,

A.J. Ostman
[EMAIL PROTECTED]

----------------------------------------------------------------------

From: "Travis Rabe" <[EMAIL PROTECTED]>
Subject: RE: [IMail Forum] Repeat Outgoing Email Problem
Date: Tue, 21 Dec 2004 17:00:50 -0800
Reply-To: [email protected]
> -----Original Message-----
> From: [EMAIL PROTECTED] [mailto:IMail_Forum-
> [EMAIL PROTECTED] On Behalf Of A.J. Ostman
> Sent: Tuesday, December 21, 2004 4:29 PM
> To: [email protected]
> Subject: [IMail Forum] Repeat Outgoing Email Problem
>
> Our installation of IMAIL 8.14 HF1 is doing some funky things in the last
> couple weeks.
>
> Sometimes, outgoing email is being sent to its destination 2-66 times
> instead of just once, despite having a successful initial delivery! I know
> this is a generic statement of the problem, but I am just curious if
> anyone
> else has been experiencing anything similar. Local mail is not duplicated,
> but outgoing email sometimes is.


What do the logs tell you? Is it one or all servers? What type of firewall are you behind? Is this all mail, or just lists? IP'd or IP'less domains?


> > Thanks, > > A.J. Ostman > [EMAIL PROTECTED] > > > To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html > List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/ > Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/


----------------------------------------------------------------------

From: "Internet Relations" <[EMAIL PROTECTED]>
Subject: [IMail Forum] domain keys
Date: Tue, 21 Dec 2004 17:12:08 -0800
Reply-To: [email protected]
Is anyone using or implementing this?

http://antispam.yahoo.com/domainkeys
----------------------------------------------------------------------

From: "Mike Hughes" <[EMAIL PROTECTED]>
Subject: [IMail Forum] Imail and Ironmail
Date: Tue, 21 Dec 2004 20:51:25 -0500
Reply-To: [email protected]
This is a multi-part message in MIME format.

------=_NextPart_000_001C_01C4E79E.D65525D0
Content-Type: text/plain;
        charset="us-ascii"
Content-Transfer-Encoding: 7bit

I have a configuration question for anyone who knows the answer.  We are
installing an anti-spam appliance called Ironmail and are planning on
pushing smtp traffic from our Imail server through it.  I know I will now
need to MX records set up, one for SMTP and the other for POP3.  I guess my
question is, what should I be naming the host on my mail server.  We already
have the host name of mail.domainname.com, can I still use this host name
but add the smtp.domainname.com and the pop3.domainname.com to the host
alias?  The more I think about it, the more I think I am confusing my self.
I'm not an email expert but I can't get that through my bosses head.  HELP!

Mike Hughes

------=_NextPart_000_001C_01C4E79E.D65525D0
Content-Type: text/html;
        charset="us-ascii"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">

I = have a configuration question for anyone who knows the answer. We = are installing an anti-spam appliance called Ironmail and are planning = on pushing smtp traffic from our Imail server through it. I know I = will now need to MX records set up, one for SMTP and the other for = POP3. I guess my question is, what should I be naming the host on = my mail server. We already have the host = name of mail.domainname.com, can I still use this host name but add the = smtp.domainname.com and the pop3.domainname.com to the host alias? = The more I think about it, the more I think I am confusing my = self. I'm not an email expert but I can't get that through my = bosses head. HELP!

Mike = Hughes
------=_NextPart_000_001C_01C4E79E.D65525D0--

----------------------------------------------------------------------

Date: Tue, 21 Dec 2004 19:15:44 -0700
From: Dave Riddle <[EMAIL PROTECTED]>
Subject: [IMail Forum] "Services" like SpamLion
Reply-To: [email protected]
I had a client ask me today to turn on an email confirmation request
service like "SpamLion" (http://www.spamlion.com/)

The "bounce" message that SpamLion sends is:
----------
An e-mail you have just sent to [EMAIL PROTECTED] is
being held until you complete a simple one-time-only registration.

To verify you are a real person, just click on the link below:
http://mail.domain.com/642302363309

Alternatively, you can use the reply button on your e-mail program to send
this message back to [EMAIL PROTECTED]

That's it!  You're done! Your original message will be on its way.

This one-time registration allows you to freely send messages to any address
at Our Company LLP.
------------------------
Below is the response that I sent him as to why a "service" like that is a
bad idea.  What say you other Mail Admins?
-----------
This is something I would have to turn on at the mail server level which I
would not want to do and would strongly recommend against that type of
software even if it could be installed at the "client" level.

There has been much discussion among the Mail Administrator community on
this type of "service".  One of the big reasons against doing it is that it
requires the sender to respond.  That works fine if the sender is a
"person" but what happens when the sender is a "service" like a bank
sending a statement (for example my bank sends me an activity report every
day and my Scottrade account does so every month too), a travel service
(Travelocity, Priceline, Southwest Airlines, etc) sending confirmation of a
reservation, notice from eBay of a winning auction, and the list of
"system" generated emails goes on and on.  A service like you are wanting
would continue to block those emails because the sender is not a person
that is capable of responding.

Another reason is that most spam uses a "spoofed" return address - meaning
that the person listed as having sent it did not really do so rather their
address was just "used" by the spammer.  This type of system will see the
innocent person whose email address was stolen getting swamped with these
type of confirmation requests.  All he has to do is register his
frustration that he is getting killed with these type of confirmations is
to reply and now all the email that is using his address will be allowed
right in to your email box because it is now "trusted".

A good example of the weakness of this type of system would be that you
would have my email address in your "trusted" list, but checking the last
week (back to 12/13/2004) worth of spam that I have quarantined (6,175
pieces of email) on the server shows that four messages sent by a computer
that is infected with a virus is using my return address as the sender.  No
telling how many more email messages spoofing either mine or other email
addresses that you would "trust" out of the +29,000 pieces of email that
failed spam checking to the point that the email was deleted without going
to quarantine.
--------------------

----------------------------------------------------------------------

Date: Tue, 21 Dec 2004 21:26:06 -0500
From: Sanford Whiteman <[EMAIL PROTECTED]>
Subject: Re: [IMail Forum] Imail and Ironmail
Reply-To: [email protected]
> I  have a configuration question for anyone who knows the answer. We
> are  installing  an  anti-spam  appliance  called  Ironmail  and are
> planning  on pushing smtp traffic from our Imail server through it.

Not just from IMail, I presume, but to IMail as well.

> I  know  I  will now need to MX records set up, one for SMTP and the
> other  for POP3. . .

MX records are only for SMTP.

> I  guess my question is, what should I be naming the host on my mail
> server.  We already have the host name of mail.domainname.com, can I
> still  use  this  host  name but add the smtp.domainname.com and the
> pop3.domainname.com to the host alias?

Why would you need a new host alias on your mailbox server? You set up
the  appliance  with  a  given hostname. That hostname becomes your MX
record,  and  the  old  one  goes away. The appliance uses an internal
routing  hostname  (such as mail.example.com), or just the IP address,
to route mail to your now-protected mailbox server.

--Sandy


------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!

http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!

http://www.mailmage.com/products/software/freeutils/exchange2aliases/downloa
d/release/

http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/re
lease/

----------------------------------------------------------------------

From: <Administrator>
Subject: [IMail Forum] [MailServer Notification]To recipient: Message
matched eManager setting and action was taken.
Date: Tue, 21 Dec 2004 21:31:01 -0500
Reply-To: [email protected]
**************** eManager Notification *****************

The following mail was blocked since it contains sensitive content.

Source mailbox: [EMAIL PROTECTED]
Destination mailbox(es): [email protected]
Rule/Policy: Trend Micro Anti-spam
Action: Quarantine to C:\Program
Files\Trend\SMCF\Quarantine\2004-12-21\21\30\Message41c8dc5d6c1.original_eml
_

Recipient, Trend Micro Anti-spam has detected a sensitive e-mail.

******************* End of message *********************
----------------------------------------------------------------------

From: "David" <[EMAIL PROTECTED]>
Subject: Re: Re[2]: [IMail Forum] Separate SMTP Server - Slightly OT?
Date: Tue, 21 Dec 2004 21:44:36 -0500
Reply-To: [email protected]
Sandy wrote:
> My  target  for the script is a system that is a DC, which will enable
> IMail  domains  to  be replicated into Active Directory OUs for easier
> manageability.  .............. and .............
> The   script   could   alternately   be   written   to   work  with  a
> workgroup/member  SAM  instead  of  AD,  but  that  won't  be my first
> objective. Let me know how this sits with you.

Sounds great to me Sandy, thanks.  We don't currently use AD but we are in
the process of bringing it up now.  So I am not very familiar with AD
myself, but I will verify it with those working on AD.  I wouldn't think
that we would want to use SAM users for this purpose anyway.

Thank again,

David Weber
Windows 2000 MCP

http://www.orcsweb.com/
Powerful Web Hosting Solutions
#1 in Service and Support



---
[This E-mail scanned for viruses by Declude Virus]

----------------------------------------------------------------------

Date: Tue, 21 Dec 2004 22:00:04 -0500
From: Sanford Whiteman <[EMAIL PROTECTED]>
Subject: Re[4]: [IMail Forum] Separate SMTP Server - Slightly OT?
Reply-To: [email protected]
> Sounds  great  to me Sandy, thanks. We don't currently use AD but we
> are  in the process of bringing it up now. So I am not very familiar
> with  AD  myself,  but  I will verify it with those working on AD.

Okay.  Just  bear  in  mind, before your AD admins freak out, that I'm
talking  about  making  the  MX  a domain controller for a _separate_,
otherwise  empty  domain. This just means that the MX's SMTP AUTH user
list  becomes  LDAP-aware, so I can (a) program it using the LDAP API,
and  (b) use OUs for each domain, instead of using one big flat domain
as with the SAM. Nothing's going to touch your corporate directory.

--Sandy


------------------------------------ Sanford Whiteman, Chief Technologist Broadleaf Systems, a division of Cypress Integrated Systems, Inc. e-mail: [EMAIL PROTECTED]

SpamAssassin plugs into Declude!

http://www.mailmage.com/products/software/freeutils/SPAMC32/download/release
/

Defuse Dictionary Attacks: Turn Exchange or IMail mailboxes into IMail
Aliases!

http://www.mailmage.com/products/software/freeutils/exchange2aliases/downloa
d/release/

http://www.mailmage.com/products/software/freeutils/ldap2aliases/download/re
lease/



To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/


To Unsubscribe: http://www.ipswitch.com/support/mailing-lists.html
List Archive: http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Knowledge Base/FAQ: http://www.ipswitch.com/support/IMail/

Reply via email to