> i'm not sure what's going on, maybe spam is being sent from a machine here, > or with a forged from: header. > > the person is getting hundreds of seemingly same, or similar bounce messages > (all in a row), mostly in german... > > they are all from postmaster and have subject Undeliverable message or > failed mail. > > any good rules to deal?
If procmail is an option the following procmail rule catches nearly 100% of the DSNs that I get, included about 60 in german yesterday. :0HB * -1^0 * 1^0 ^FROM_MAILER * 1^0 ^Status: 4.2.0 * 1^0 ^Status: 4.4.1 * 1^0 ^Status: 4.4.2 * 1^0 ^Status: 4.4.6 * 1^0 ^Status: 4.4.7 * 1^0 ^Status: 5.0.0 * 1^0 ^Status: 5.1.1 * 1^0 ^Status: 5.1.2 * 1^0 ^Status: 5.1.6 * 1^0 ^Status: 5.2.1 * 1^0 ^Status: 5.2.2 * 1^0 ^Status: 5.2.3 * 1^0 ^Status: 5.3.5 * 1^0 ^Status: 5.4.7 * 1^0 ^Status: 5.5.0 * 1^0 ^Status: 5.7.1 * 1^0 ^554 5.0.0 Service unavailable .* * 1^0 ^Remote host said: 550.*User unknown * 1^0 ^Remote host said: 554.*doesn't have a yahoo.com account.* * 1^0 ^User.*not listed in public Name & Address Book * 1^0 ^Sorry, no mailbox here by that name. * 1^0 ^<.*>: Unkown user: * 1^0 ^User mailbox exceeds allowed size: * 1^0 ^.*No matches to nameserver query * 1^0 ^A message that you sent could not be delivered * 1^0 ^.*550 unknown user * 1^0 ^This is a permanent error; I've given up. * 1^0 ^The user(s) account is temporarily over quota. * 1^0 ^Receiver not found:.* * 1^0 ^Requested action not taken: mailbox unavailable. * 1^0 ^--AOL Postmaster * 1^0 ^I'm sorry to have to inform you that the message returned * 1^0 ^550 5.1.1 <.*>... User unknown * 1^0 ^550 <.*>\.\.\. User unknown * 1^0 ^Subject:.*failure notice * 1^0 ^did not reach the following recipient\(s\): * 1^0 ^The following recipient(s) could not be reached: * 1^0 ^.*550 Mailbox quota exceeded * 1^0 ^.*550 Access Denied * 1^0 ^550 5.0.0.*Can't create output * 1^0 ^.*There is no such addressee as * 1^0 ^Mail Delivery Failed... User unknown dns-bounces.txt
