RE: Bogus MAIL FROM (SPAM)

[Aaron Newcomb]

Title: RE: Bogus MAIL FROM (SPAM)

There must be some way to block this mail from coming through. It would be ideal to block based on the HELO response since they can't fake that.

 

Aaron

-----Original Message-----
From: Tony Publiski (tonyp) [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 13, 2000 11:30 PM
To: 'Aaron Newcomb'; [EMAIL PROTECTED]
Subject: RE: Bogus MAIL FROM (SPAM)

No matter what they're always going to be able to send mail to a domain hosted on your box...your only chance is to learn to use your delete key...

Tony

-----Original Message-----
From: Aaron Newcomb [mailto:[EMAIL PROTECTED]]
Sent: Friday, October 13, 2000 11:20 PM
To: [EMAIL PROTECTED]
Subject: Bogus MAIL FROM (SPAM)

I am having trouble with SPAM from people who provide bogus From and To
lines when talking to my qmail server. Here is an example.

Oct 12 21:47:49 linux1 smtpd: 971401669.546402 2385 > 220 ns1.newcombnet.com
ES
Oct 12 21:47:52 linux1 smtpd: 971401672.921618 2385 < HELO
att.attsoken.co.jp?
Oct 12 21:47:52 linux1 smtpd: 971401672.922747 2385 > 250
ns1.newcombnet.com?
Oct 12 21:47:53 linux1 smtpd: 971401673.298142 2385 < MAIL
FROM:<[EMAIL PROTECTED]>
Oct 12 21:47:53 linux1 smtpd: 971401673.299236 2385 > 250 ok?
Oct 12 21:47:53 linux1 smtpd: 971401673.568619 2385 < RCPT
TO:<[EMAIL PROTECTED]>

Notice that the HELO and the MAIL FROM: lines have completely different
domains. The MAIL FROM they are using is a bogus address. What is the best
way to prevent email like this from being accepted?

Thanks,
Aaron Newcomb, MCSE
http://www.newcombnet.com
[EMAIL PROTECTED]