we have sort of two processors set up in our config - one for processing inbound mails and the other for outbound so on top of inbound processor u can perhaps add a HostIs matcher to check that if that helps : SHOUT ALOUD ! JAMES ROCKS ! regards,
Chris Hane <[EMAIL PROTECTED]> wrote: You are correct it is not coming from my server. And I'm aware of spam like this that I can not stop on my server.... I'm asking a bit of a different question. A third party is sending mail to me ([EMAIL PROTECTED]). They have set the FROM address to be ([EMAIL PROTECTED]). In this case, James is getting the email and delivering it to me. What I wonder is there a configuration setting or matcher/mailet that can detect this and do something (e.g., mark is as spam, or just reject it entirely) with the email. Chris.... JWM wrote: >Chris, > >99% chance it has nothing to do with your server. That mail never came >close to your server. Anyone can put any return address they want on an >email. What typically happens is that viruses on user's machines will >harvest addresses from the user's inbox and use them as return addresses for >spam. > >So the good news is that it isn't coming from your server, and therefore you >don't have a virus or security hole. The bad news is that isn't coming from >your server, and therefore there is absolutely nothing you can do to prevent >it. > >Jerry > >-----Original Message----- >From: Chris Hane [mailto:[EMAIL PROTECTED] >Sent: Wednesday, November 23, 2005 9:26 AM >To: [email protected] >Subject: How to stop Spam sent to my domain FROM my domain? > > >I have a pretty vanilla James (latest released version) installation. > >I am receiving spam from third parties with the FROM set to an address >in my domain (for example the from is [EMAIL PROTECTED]). I'm assuming >this is some type of virus on the sending machine. > >Is there a configuration option or mailet/matcher that will verify that >if the FROM address is using a domain being managed by James, that the >email user must be authenticated? > >I have James setup so that authentication is required to send/receive >email using the server. However, if email is being sent to me, the FROM >address can be anything, which includes addresses in my domain. > >It's causing a bit of confusion in my user base because the emails look >like the are coming from legit addresses. Our virus software is >stripping out the viruses, so I'm not worried (right now) about >virus...this is more a support issue with my users. > >Thanks in advance, >Chris.... > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: [EMAIL PROTECTED] > > > >--------------------------------------------------------------------- >To unsubscribe, e-mail: [EMAIL PROTECTED] >For additional commands, e-mail: [EMAIL PROTECTED] > > > > > --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED] --------------------------------- Yahoo! FareChase - Search multiple travel sites in one click.
