RE: New kind of messages, blew right through my Trashfinder !

[John Martoccio]

THIS COULD BE A BIG PROBLEM !       Here I thought I found the "holy grail" of email....in TrashFinder !   I love the Exceptions Pass filter (which I call the PASS-THROUGH filter to my clients), and have been relying on it heavily. Only an extremely small amount of valid mail is getting caught daily, as a result of fully utilizing it.   What could be done to effectively do what your suggesting, is add another field "Authenticate" where if blank, would not require the sending server to be a specific criteria (i.e. ameritech.net  or an IP), but if the field is filled in, then not only would the [EMAIL PROTECTED] be allowed in to pass messages, but the Authenticate field would also have to match.   This could be done, with some programming work, if you used the top DNS authentication line in the header (the one that is looked up), to match to.  If the person is a roaming server, then they would need an entry for each authenticate, and the program would need to keep looking for more matching users to authenticate against.       If this isn't done, this could potentially allows spammers to RELAY using the "From:" address as the entry into our systems, and they could either "CC: or BCC:" to all of their mailing list !       This could be a plug-in of it's own, instead of part of Trashfinder, but it would be a hell of a lot more convenient to enter the information into the same place !      At this point, I want to hear Randy's thoughts.....   John Martoccio Intelligent Solutions (a computer VAR) Fox Lake, IL, USA [EMAIL PROTECTED]       P.S.:   Personal Opinion for U.S. ISP's:    I may be using the program slightly differently than many of you, as I have nothing set to delete, and everything is set to trash.  I then review all messages, and move all spam mail to a holding folder on the desktop, where I create a CD of all spam, as evidence to turn over to the police under the HARASSMENT statutes.   I am getting thousands of unwanted spam every month, obviously from the same people using false identities.  I feel that it is our responsibility as ISP's to report these.   And by U.S. law, it is the  responsibility of the police to enforce the law, or they could be guilty of misfeasance, malfeasance, and obstruction of justice.  Eventually the authorities will have to start convicting these people.  We already have all the laws we need to stop this, we just need to hold the authorities accountable to go after these people.  The authorities may need to purchase equipment, hire programmers, etc., to get this done, but that is their job.  By not reporting, we are not doing ourselves any good. Start with a local police report.  It is not your responsibility to locate the correct agency to report it to, it's theirs.  Failing to take the report is a crime also.  Follow it up in a few months.  If they failed to do anything, send me an email off list.  It's time we started holding these people accountable.   -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]On Behalf Of BSarton Sent: Friday, January 16, 2004 4:34 AM To: imsusers@rockliffe.com Subject: Re: New kind of messages, blew right through my Trashfinder ! David,   the MX gives the incoming server for the domain. The origin ip adress (the SMTP server) can be - and often is - on another class and can legitimately change ( when the sender is roaming ) I do not think that your suggestion is possible given the existing protocols   Benoit   As you say, Randy, "From" addresses are easy to fake; but what about the originator's IP address? Could Trashfinder do an MX lookup on the domain part of the "From" address and then compare it with the actual originator's IP address? This would only be necessary for "Pass" addresses. David