Well, I'd ask if there is any possibility some activity of the network
filtering smtp gateway is earning it a birth in the spammer's hall of
fame known as black lists. Are you sending wild rejects to forged
senders rather than the real senders, who are never there to receive
it anyway? Is the machine usable as an open relay for spam?
I'd certainly jettison the .biz TLD. It seems only spammers have them.
ut to get on the SURBL lists your system had to spray some unwanted mail
somewhere seriously.
{^_^}
----- Original Message -----
From: "François Conil" <[EMAIL PROTECTED]>
Hello,
I'm facing a curious problem : for 3-4 days, one of my users have been
triggering all rbls each time a mail is sent.
It could not be that serious, weren't for the identity of this
particular user : the root user on our network filtering smtp gateway.
Basically, the daily report triggers the tests like this :
BIZ_TLD=2.013,
DOMAIN_4U2=1.994,
INFO_TLD=1.273,
MR_DEPOT_URI=0.3,
NORMAL_HTTP_TO_IP=0.175,
NO_RELAYS=-0.001,
SPOOF_OURI=0.104,
URIBL_JP_SURBL=4.087,
URIBL_OB_SURBL=3.008,
URIBL_WS_SURBL=2.14,
URI_4YOU=0.135,
URI_NOVOWEL=0.884
(carriage returns added for an easier reading)
Do you see why all those tests are triggered ?
My first guess was that they are because of all the returned mail sent
by the smtp filter, which makes the daily report by itself containing a
lot of "spammy" material, in terms of domain names/ips.
Thanks by advance,
--
François Conil
Administrateur Systèmes et Réseaux
<Pax> I wish my lawn was emo, so it would cut itself.
