Re: blacklist(s)

2004-06-20 Thread David Fleck
On Fri, 14 May 2004, Warren Block wrote:
 On Fri, 14 May 2004, Gary Kline wrote:
  Can anyone point me to the website that told how to set up
  sendmail's FEATURE to use blacklists?  There were at least
  fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
  can't find it?

 There should already be an example in /etc/mail/freebsd.mc (no
 linewrap):

 dnl FEATURE(dnsbl, `blackholes.mail-abuse.org', `550 Mail from  ${client_addr}  
 rejected, see http://mail-abuse.org/cgi-bin/lookup?; ${client_addr}')
[...]

Sorry for this monumentally stupid-sounding question, but how do you tell
if the dnsbl feature is *working* or not?  I've got 2 set in my local .mc
files:

FEATURE(dnsbl, `bl.spamcop.net', `550 Mail from  ${client_addr}  rejected, see 
http://spamcop.net/bl.shtml?; ${client_addr}')
FEATURE(dnsbl,`combined.njabl.org',`Message from ${client_addr} rejected - see 
http://njabl.org/lookup?${client_addr}')

(and yes, I did 'make cf install' afterwards), but I don't see any
indication of mail being rejected because of these in my maillog.  I do
see mail being rejected because of settings in /etc/mail/access.db.  Do
these work silently, or are they not working at all?

--
David Fleck
[EMAIL PROTECTED]

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-06-20 Thread Matthew Seaman
On Sun, Jun 20, 2004 at 08:24:16AM -0500, David Fleck wrote:
 On Fri, 14 May 2004, Warren Block wrote:
  On Fri, 14 May 2004, Gary Kline wrote:
 Can anyone point me to the website that told how to set up
 sendmail's FEATURE to use blacklists?  There were at least
 fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
 can't find it?
 
  There should already be an example in /etc/mail/freebsd.mc (no
  linewrap):
 
  dnl FEATURE(dnsbl, `blackholes.mail-abuse.org', `550 Mail from  ${client_addr} 
   rejected, see http://mail-abuse.org/cgi-bin/lookup?; ${client_addr}')
 [...]
 
 Sorry for this monumentally stupid-sounding question, but how do you tell
 if the dnsbl feature is *working* or not?  I've got 2 set in my local .mc
 files:
 
 FEATURE(dnsbl, `bl.spamcop.net', `550 Mail from  ${client_addr}  rejected, see 
 http://spamcop.net/bl.shtml?; ${client_addr}')
 FEATURE(dnsbl,`combined.njabl.org',`Message from ${client_addr} rejected - see 
 http://njabl.org/lookup?${client_addr}')
 
 (and yes, I did 'make cf install' afterwards), but I don't see any
 indication of mail being rejected because of these in my maillog.  I do
 see mail being rejected because of settings in /etc/mail/access.db.  Do
 these work silently, or are they not working at all?

You'll see messages being rejected in your maillog -- like this:

Jun 20 12:41:17 happy-idiot-talk sm-mta[50011]: i5KBf8LW050011: 
ruleset=check_rcpt, arg1=[EMAIL PROTECTED], relay=c-67-162-153-95.client.comcast.net 
[67.162.153.95], reject=550 5.7.1 [EMAIL PROTECTED]... Mail from 67.162.153.95 
rejected using spamcop.net DNSBL. See 
http://spamcop.net/w3m?action=checkblockip=67.162.153.95

If you aren't seeing any rejects then either you haven't installed the
modified sendmail.cf and restarted sendmail properly:

# cd /etc/mail
# make 
# make install
# make restart

or you simply haven't had any spam from blacklisted addresses.

Cheers,

Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.   26 The Paddocks
  Savill Way
PGP: http://www.infracaninophile.co.uk/pgpkey Marlow
Tel: +44 1628 476614  Bucks., SL7 1TH UK


pgpAVWAkOTMSt.pgp
Description: PGP signature


Re: blacklist(s)

2004-06-20 Thread Warren Block
On Sun, 20 Jun 2004, David Fleck wrote:
Sorry for this monumentally stupid-sounding question, but how do you tell
if the dnsbl feature is *working* or not?  I've got 2 set in my local .mc
files:
FEATURE(dnsbl, `bl.spamcop.net', `550 Mail from  ${client_addr}  rejected, see 
http://spamcop.net/bl.shtml?; ${client_addr}')
FEATURE(dnsbl,`combined.njabl.org',`Message from ${client_addr} rejected - see 
http://njabl.org/lookup?${client_addr}')
(and yes, I did 'make cf install' afterwards), but I don't see any
indication of mail being rejected because of these in my maillog.  I do
see mail being rejected because of settings in /etc/mail/access.db.  Do
these work silently, or are they not working at all?
After changing the .mc file, you have to restart sendmail:
# cd /etc/mail
# make all install restart
DSNBL rejects look like the ones caused by entries in access.db, but 
with the message from the FEATURE line.

-Warren Block * Rapid City, South Dakota USA
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-16 Thread Chuck Swiger
Gary Kline wrote:
On Fri, May 14, 2004 at 10:00:58PM -0400, Chuck Swiger wrote:
According to the RFCs, one MUST NOT bounce mail sent to postmaster.
One ought to read the rfc-ignorant.org site I mentioned.
[ ... ]
	Well, bit again.  The line in my access file was 

206.46  550 Verizon email not wanted here
	that I've commented out. This isn't the first time I've had 
	to fine tune; it probably won't be the last.  Apologies!
Consider using FEATURE(`delay_checks', `friend') and add the following to the 
access map:

Spam:abuse@ FRIEND
Spam:postmaster@FRIEND
[ Pre 8.12 versions of sendmail use To: instead ]
...which will allow you to block mail as you please using IP or other reject 
rules, yet not prevent delivery of mail to postmaster and abuse...

--
-Chuck
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-16 Thread Gary Kline
On Sun, May 16, 2004 at 10:01:54AM -0400, Chuck Swiger wrote:
 Gary Kline wrote:
 On Fri, May 14, 2004 at 10:00:58PM -0400, Chuck Swiger wrote:
 According to the RFCs, one MUST NOT bounce mail sent to postmaster.
 One ought to read the rfc-ignorant.org site I mentioned.
 [ ... ]
  Well, bit again.  The line in my access file was 
 
  206.46  550 Verizon email not wanted here
 
  that I've commented out. This isn't the first time I've had 
  to fine tune; it probably won't be the last.  Apologies!
 
 Consider using FEATURE(`delay_checks', `friend') and add the following to 
 the access map:
 
 Spam:abuse@   FRIEND
 Spam:postmaster@  FRIEND
 
 [ Pre 8.12 versions of sendmail use To: instead ]
 
 ...which will allow you to block mail as you please using IP or other 
 reject rules, yet not prevent delivery of mail to postmaster and abuse...
 

Outstanding idea, at least it seems.  This site has all
the details:

http://www.technoids.org/spamlovers.html

I think that most email to postmaster should be allowed,
any everything to abuse.

thanks for the tip! (and a tip of the hat),

gary


-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-16 Thread Micheal Patterson


- Original Message - 
From: Gary Kline [EMAIL PROTECTED]
To: Chuck Swiger [EMAIL PROTECTED]
Cc: FreeBSD Mailing List [EMAIL PROTECTED]
Sent: Sunday, May 16, 2004 3:14 PM
Subject: Re: blacklist(s)


 On Sun, May 16, 2004 at 10:01:54AM -0400, Chuck Swiger wrote:
  Gary Kline wrote:
  On Fri, May 14, 2004 at 10:00:58PM -0400, Chuck Swiger wrote:
  According to the RFCs, one MUST NOT bounce mail sent to
postmaster.
  One ought to read the rfc-ignorant.org site I mentioned.
  [ ... ]
   Well, bit again.  The line in my access file was
  
   206.46  550 Verizon email not wanted here
  
   that I've commented out. This isn't the first time I've had
   to fine tune; it probably won't be the last.  Apologies!
 
  Consider using FEATURE(`delay_checks', `friend') and add the
following to
  the access map:
 
  Spam:abuse@ FRIEND
  Spam:postmaster@ FRIEND
 
  [ Pre 8.12 versions of sendmail use To: instead ]
 
  ...which will allow you to block mail as you please using IP or
other
  reject rules, yet not prevent delivery of mail to postmaster and
abuse...
 

 Outstanding idea, at least it seems.  This site has all
 the details:

 http://www.technoids.org/spamlovers.html

 I think that most email to postmaster should be allowed,
 any everything to abuse.

 thanks for the tip! (and a tip of the hat),

 gary


 -- 
Gary Kline [EMAIL PROTECTED]   www.thought.org Public
service Unix


Delay_checks does indeed work. However, there are some side effects that
need to be taken into consideration.

Since you're basically filtering on the delivery of the message,
sendmail doesn't check if the user exists until after acceptance. This
means, that for each and every spam message you receive for an invalid
user, Sendmail has to send a bounce back to the originator. See the
gotcha yet? If not read on. :)

For example, let's say, your mail server handles 50 - 100 thousand
messages every 24 hours, and 25 thousand of those are spam. Not too
uncommon in today's internet. Now, let's say that of those 25 thousand
messages, 20 thousand (conservative number) have forged return
addresses. You don't see these forgeries on unknown users under
Sendmail's normal config as the message is rejected at connection time.
Still don't see the gotcha? That's ok. I didn't either at first when it
happened to me. Let me explain what I saw with it.

If sendmail bounces after message acceptance, it now has to send a
bounce to each of those 20 thousand forged addresses. Each of those
messages will then bounce and return to postmaster after it can't
deliver them and at least, 2 things will most definitely occur.

1. The amount of mail sitting in your mail queue will increase.

2. The amount of mail to postmaster will most definitely increase as
these messages fail delivery to the forged originators.

If you're like me, you tend to keep tabs on your postmaster email for
possible problems, but in my experience, my mail load, both for the
server and in my mailbox, jumped 150% on my 2 mx's because of
delay_check. I ended up disabling delay_check and using amavisd and
spamassassin so that I can filter on connection.

I personally don't recommend delay_check to be enabled on a large
production mta. For smaller systems that don't pass a lot of email, it's
fine. However, for larger systems, I'd recommend using a different
method.

--

Micheal Patterson
TSG Network Administration
405-917-0600

Confidentiality Notice:  This e-mail message, including any attachments,
is
for the sole use of the intended recipient(s) and may contain
confidential
and privileged information. Any unauthorized review, use, disclosure or
distribution is prohibited. If you are not the intended recipient,
please
contact the sender by reply e-mail and destroy all copies of the
original
message.

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-16 Thread Gary Kline
On Sun, May 16, 2004 at 04:02:33PM -0500, Micheal Patterson wrote:
 
 
 - Original Message - 
 From: Gary Kline [EMAIL PROTECTED]
 To: Chuck Swiger [EMAIL PROTECTED]
 Cc: FreeBSD Mailing List [EMAIL PROTECTED]
 Sent: Sunday, May 16, 2004 3:14 PM
 Subject: Re: blacklist(s)
 
 
  On Sun, May 16, 2004 at 10:01:54AM -0400, Chuck Swiger wrote:
   Gary Kline wrote:
   On Fri, May 14, 2004 at 10:00:58PM -0400, Chuck Swiger wrote:
   According to the RFCs, one MUST NOT bounce mail sent to
 postmaster.
   One ought to read the rfc-ignorant.org site I mentioned.
   [ ... ]
Well, bit again.  The line in my access file was
   
206.46  550 Verizon email not wanted here
   
that I've commented out. This isn't the first time I've had
to fine tune; it probably won't be the last.  Apologies!
  
   Consider using FEATURE(`delay_checks', `friend') and add the
 following to
   the access map:
  
   Spam:abuse@ FRIEND
   Spam:postmaster@ FRIEND
  
   [ Pre 8.12 versions of sendmail use To: instead ]
  
   ...which will allow you to block mail as you please using IP or
 other
   reject rules, yet not prevent delivery of mail to postmaster and
 abuse...
  
 
  Outstanding idea, at least it seems.  This site has all
  the details:
 
  http://www.technoids.org/spamlovers.html
 
  I think that most email to postmaster should be allowed,
  any everything to abuse.
 
  thanks for the tip! (and a tip of the hat),
 
  gary
 
 
  -- 
 Gary Kline [EMAIL PROTECTED]   www.thought.org Public
 service Unix
 
 
 Delay_checks does indeed work. However, there are some side effects that
 need to be taken into consideration.
 
 Since you're basically filtering on the delivery of the message,
 sendmail doesn't check if the user exists until after acceptance. This
 means, that for each and every spam message you receive for an invalid
 user, Sendmail has to send a bounce back to the originator. See the
 gotcha yet? If not read on. :)
 
 For example, let's say, your mail server handles 50 - 100 thousand
 messages every 24 hours, and 25 thousand of those are spam. Not too
 uncommon in today's internet. Now, let's say that of those 25 thousand
 messages, 20 thousand (conservative number) have forged return
 addresses. You don't see these forgeries on unknown users under
 Sendmail's normal config as the message is rejected at connection time.
 Still don't see the gotcha? That's ok. I didn't either at first when it
 happened to me. Let me explain what I saw with it.
 
 If sendmail bounces after message acceptance, it now has to send a
 bounce to each of those 20 thousand forged addresses. Each of those
 messages will then bounce and return to postmaster after it can't
 deliver them and at least, 2 things will most definitely occur.
 
 1. The amount of mail sitting in your mail queue will increase.
 
 2. The amount of mail to postmaster will most definitely increase as
 these messages fail delivery to the forged originators.
 
 If you're like me, you tend to keep tabs on your postmaster email for
 possible problems, but in my experience, my mail load, both for the
 server and in my mailbox, jumped 150% on my 2 mx's because of
 delay_check. I ended up disabling delay_check and using amavisd and
 spamassassin so that I can filter on connection.
 
 I personally don't recommend delay_check to be enabled on a large
 production mta. For smaller systems that don't pass a lot of email, it's
 fine. However, for larger systems, I'd recommend using a different
 method.
 

Appreciate your input.  I was thinking of the side-affect
bounces--that's why I qualified with 'at least it seems'.

For now, for maybe some small-N days, I'll enable the
delay_check feature.  If I get slogged by tons of junk,
I'll rely on dspam (or another filter).  Like just about
everything else, this is a learn-by-experience.

gary


-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Jay Moore
On Friday 14 May 2004 07:55 pm, Gary Kline wrote:

   Can anyone point me to the website that told how to set up
   sendmail's FEATURE to use blacklists?  There were at least
   fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
   can't find it?

Most DNSBLs have a how-to page with sendmail configuration examples. The 
sendmail site itself is pretty clear on how to do this (www.sendmail.org)

   Any thoughts on spamcop.com?

I use it, and I feed my spam to it. I think their approach to blacklisting is 
pretty unique... it's not the central authority model, it's more like a 
popular vote model. Anyone can vote by feeding their spam to spamcop.

Downside(s)?? 

1) Their servers apparently get overloaded sometimes, and don't respond. This 
can lead to two things - both of which are bad:
  spam gets through if you don't defer
  good mail gets delayed if you do defer
2) There was some flack a few months ago about spamcop being bought by a 
commercial outfit. You can Google for the news on this

Finally - www.DNSstuff.com, the Spam database lookup is a great source of 
comparison between all or most of the available blacklists.

HTH,
Jay


   tia, people,

   gary
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Chris
On Saturday 15 May 2004 02:21 am, Jay Moore wrote:
 On Friday 14 May 2004 07:55 pm, Gary Kline wrote:
  Can anyone point me to the website that told how to set up
  sendmail's FEATURE to use blacklists?  There were at least
  fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
  can't find it?

You also need to consider that using multiple RBL's help. My *.mc file has 
about 8 RBL sites. The amount of spam is perhaps 2 or 3 mails a day.

Just a few pennies ...

-- 
Best regards,
Chris
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Gary Kline
On Fri, May 14, 2004 at 07:35:06PM -0600, Warren Block wrote:
 On Fri, 14 May 2004, Gary Kline wrote:
 
  Can anyone point me to the website that told how to set up
  sendmail's FEATURE to use blacklists?  There were at least
  fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
  can't find it?
 
 There should already be an example in /etc/mail/freebsd.mc (no
 linewrap):
 
 dnl FEATURE(dnsbl, `blackholes.mail-abuse.org', `550 Mail from  ${client_addr}  
 rejected, see http://mail-abuse.org/cgi-bin/lookup?; ${client_addr}')
 
 Change the relevant information to use DNSBLs.  For example, here's the
 one I use for the excellent XBL-SBL list:
 
 FEATURE(`dnsbl', `sbl-xbl.spamhaus.org', `554 Mail from  ${client_addr}  
 rejected, site listed on http://www.spamhaus.org;')
 


Thanks to everybody.  The one website that showed howto install
spamassassim and-or these blacklist sites (with sendmail) seemed
to suggest not to use too many sites.  I dropped in two sites
and noticed the misc spam  fall off just since noon, Seattle time.  

I just installed the new dspam (2.10.6) and got the mysql link
going.  When I have this working too I'll write up a cheat-sheet
tutorial and put it up at bsd.thought.org.  

gary

PS: Warren, while I was poking around this morning I found 
spamhaus's list.  These guys get 5 gold stars... .




-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Gary Kline
On Fri, May 14, 2004 at 10:00:58PM -0400, Chuck Swiger wrote:
 Gary Kline wrote:
 [ ...speaking of anti-spam... ]
 
 According to the RFCs, one MUST NOT bounce mail sent to postmaster.
 One ought to read the rfc-ignorant.org site I mentioned.
 
 Oddly enough, even spammers tend not to spam [EMAIL PROTECTED], 
 perhaps if only because the postmaster tends to be willing and able to 
 respond to spam effectively.  :-/
 

Well, bit again.  The line in my access file was 

206.46  550 Verizon email not wanted here

that I've commented out. This isn't the first time I've had 
to fine tune; it probably won't be the last.  Apologies!

gary



-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Gary Kline
On Fri, May 14, 2004 at 11:20:28PM -0400, Jim Trigg wrote:
 --On Friday, May 14, 2004 5:55 PM -0700 Gary Kline [EMAIL PROTECTED] 
 wrote:
 
  Any thoughts on spamcop.com?
 
 AFAIK, you mean spamcop.net (from what I can tell, spamcop.com does not 
 have a blacklist, just a reporting feature and an ad for a Windows-based 
 spam blocking program.
 
 The spamcop.net blacklist is somewhat controversial; some people find it 
 too prone to false positives.  I personally won't use it to bounce mail, 
 just to mark mail as suspected spam.
 

Thanks for the data-point.  I backed off when I saw that 
spamcop.com was (1) for Doze clients and (2) wanted bux.
If spamcop.net has a lot of false positives, then it's
a no-go.  People I've known for years were seriously pissed
when their mail was 550'd. --Of course they had no clue.  
Here at least we're mostly techies... .

gary

-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-15 Thread Warren Block
On Sat, 15 May 2004, Gary Kline wrote:

 Thanks to everybody.  The one website that showed howto install
 spamassassim and-or these blacklist sites (with sendmail) seemed
 to suggest not to use too many sites.

Probably to avoid confusion on the user's part.  As long as you
understand each DNSBL's listing reasons, there's no real reason not to
use several.  Speed of DNS lookups could slow mail delivery.  Put the
larger, aggregate lists like sbl-xbl.spamhaus.org and list.dsbl.org
first to get the most from each lookup.

 PS: Warren, while I was poking around this morning I found
 spamhaus's list.  These guys get 5 gold stars... .

Yes, the sbl-xbl lists are excellent.  Conservative but effective.

Installing the clamav-milter in addition to DNSBLs helps tremendously.
The daily barrage of Windows viruses just disappears.

-Warren Block * Rapid City, South Dakota USA
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


blacklist(s)

2004-05-14 Thread Gary Kline

Can anyone point me to the website that told how to set up
sendmail's FEATURE to use blacklists?  There were at least
fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
can't find it?

Any thoughts on spamcop.com?

tia, people,

gary

-- 
   Gary Kline [EMAIL PROTECTED]   www.thought.org Public service Unix

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-14 Thread Gary
On Fri, May 14, 2004 at 05:55:03PM -0700 or thereabouts, Gary Kline wrote:
 
   Can anyone point me to the website that told how to set up
   sendmail's FEATURE to use blacklists?  There were at least
   fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
   can't find it?

Sorry, Gary, can't help you here, I don't use Sendmail
 
   Any thoughts on spamcop.com?

I have spamcop setup as an RBL on my system, and yesterday alone, they
blocked over 400 spam attempts. I like them, and have not had any
complaints of false listings... I have been using them for over 2 years.

-- 
Gary

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-14 Thread Chuck Swiger
Gary Kline wrote:
Can anyone point me to the website that told how to set up
sendmail's FEATURE to use blacklists?  There were at least
fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
can't find it?
http://www.sendmail.org/m4/anti_spam.html
http://mail-abuse.org/
http://www.rfc-ignorant.org/how_to_domain.php
	Any thoughts on spamcop.com?
They're OK...
--
-Chuck
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-14 Thread Warren Block
On Fri, 14 May 2004, Gary Kline wrote:

   Can anyone point me to the website that told how to set up
   sendmail's FEATURE to use blacklists?  There were at least
   fourr blacklist sites.  I've grep'd thru my ~/Mail directory,
   can't find it?

There should already be an example in /etc/mail/freebsd.mc (no
linewrap):

dnl FEATURE(dnsbl, `blackholes.mail-abuse.org', `550 Mail from  ${client_addr}  
rejected, see http://mail-abuse.org/cgi-bin/lookup?; ${client_addr}')

Change the relevant information to use DNSBLs.  For example, here's the
one I use for the excellent XBL-SBL list:

FEATURE(`dnsbl', `sbl-xbl.spamhaus.org', `554 Mail from  ${client_addr}  rejected, 
site listed on http://www.spamhaus.org;')

-Warren Block * Rapid City, South Dakota USA
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-14 Thread Chuck Swiger
Gary Kline wrote:
[ ...speaking of anti-spam... ]
According to the RFCs, one MUST NOT bounce mail sent to postmaster.
One ought to read the rfc-ignorant.org site I mentioned.
Oddly enough, even spammers tend not to spam [EMAIL PROTECTED], perhaps 
if only because the postmaster tends to be willing and able to respond to spam 
effectively.  :-/

--
-Chuck
begin forwarded message-
This Message was undeliverable due to the following reason:
Your message was not delivered because the return address was refused.
The return address was '[EMAIL PROTECTED]'
Please reply to [EMAIL PROTECTED]
if you feel this message to be in error.

Reporting-MTA: dns; out007.verizon.net
Arrival-Date: Fri, 14 May 2004 20:39:04 -0500
Received-From-MTA: dns; mac.com (68.161.84.3)
Final-Recipient: RFC822; [EMAIL PROTECTED]
Action: failed
Status: 5.1.1
Remote-MTA: dns; ns1.thought.org (216.231.43.140)
Diagnostic-Code: smtp; 550 5.0.0 Verizon email not wanted here

Subject: Re: blacklist(s)
From: Chuck Swiger [EMAIL PROTECTED]
Date:Fri, 14 May 2004 21:40:55 -0400
To: [EMAIL PROTECTED]
Gary Kline wrote:
[ ... ]
Ack!  I don't have a problem with refusing mail from *.dsl.verizon.net, or 
with *.client.comcast.net, or any other dialup/broadband range, but bouncing 
authenticated mail relayed via Verizon's mailservers is probably excessive.

--
-Chuck
---begin forwarded message, snip to actual bounce message--
This Message was undeliverable due to the following reason:
Your message was not delivered because the return address was refused.
The return address was '[EMAIL PROTECTED]'
Please reply to [EMAIL PROTECTED]
if you feel this message to be in error.
--===_ _= 3369445(29216)1084583438
Content-Type: message/delivery-status
Reporting-MTA: dns; out009.verizon.net
Arrival-Date: Fri, 14 May 2004 20:10:25 -0500
Received-From-MTA: dns; mac.com (68.161.84.3)
Final-Recipient: RFC822; [EMAIL PROTECTED]
Action: failed
Status: 5.1.1
Remote-MTA: dns; ns1.thought.org (216.231.43.140)
Diagnostic-Code: smtp; 550 5.0.0 Verizon email not wanted here
--===_ _= 3369445(29216)1084583438
Content-Type: message/rfc822
Received: from mac.com ([68.161.84.3]) by out009.verizon.net
  (InterMail vM.5.01.06.06 201-253-122-130-106-20030910) with ESMTP
  id [EMAIL PROTECTED];
  Fri, 14 May 2004 20:10:25 -0500
Message-ID: [EMAIL PROTECTED]
Date: Fri, 14 May 2004 21:12:16 -0400
From: Chuck Swiger [EMAIL PROTECTED]
Organization: The Courts of Chaos
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7b) 
Gecko/20040421
X-Accept-Language: en-us, en
MIME-Version: 1.0
To: Gary Kline [EMAIL PROTECTED]
CC: FreeBSD Mailing List [EMAIL PROTECTED]
Subject: Re: blacklist(s)
References: [EMAIL PROTECTED]
In-Reply-To: [EMAIL PROTECTED]
Content-Type: text/plain; charset=us-ascii; format=flowed
Content-Transfer-Encoding: 7bit
X-Authentication-Info: Submitted using SMTP AUTH at out009.verizon.net from 
[68.161.84.3] at Fri, 14 May 2004 20:10:25 -0500

___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]


Re: blacklist(s)

2004-05-14 Thread Jim Trigg
--On Friday, May 14, 2004 5:55 PM -0700 Gary Kline [EMAIL PROTECTED] 
wrote:

	Any thoughts on spamcop.com?
AFAIK, you mean spamcop.net (from what I can tell, spamcop.com does not 
have a blacklist, just a reporting feature and an ad for a Windows-based 
spam blocking program.

The spamcop.net blacklist is somewhat controversial; some people find it 
too prone to false positives.  I personally won't use it to bounce mail, 
just to mark mail as suspected spam.

Jim
--
Jim Trigg, Lord High Everything Else  O-  /\
 \ /  ASCII RIBBON CAMPAIGN
Hostmaster, Huie Kin family websiteXHELP CURE HTML MAIL
Verger, All Saints Church - Sharon Chapel / \
___
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to [EMAIL PROTECTED]