Re: qconfirm-inject/qconfirm-notice

On Mon, Dec 01, 2003 at 11:57:43AM +0100, Gerrit Pape wrote:
> On Sun, Nov 30, 2003 at 05:20:42PM -0500, Chris Johnson wrote:
> > qconfirm protected address, the "please confirm your message" message
> > is delivered to my mailbox, instead of being handled automatically by
> > qconfirm-notice. Does anyone know what would cause qconfirm-notice not
> > to recognize a confirmation request?
> 
> qconfirm-notice looks at the Message-ID of the confirmation request, and
> since version 0.12.0 qconfirm-check creates a special Message-ID for
> confirmation requests.  Most probably this particular address runs a
> previous version of qconfirm.

Yes, that was the case. I've since upgraded that server, and the confirmation
process went as expected.

> When using qconfirm-inject for all your mails, you could reject or drop
> mails with an empty envelope sender sent to your public mail address, as
> they only can be bounces from really broken MTAs.

Speaking of bounces from really broken MTAs, the only spam that gets through
qconfirm these days comes from addresses whose MTAs bounce to the address in
the From header. If I get a message from [email protected], and
example.com's MTA sends a bounce message to the special qconfirm address in the
From header, the message is confirmed and I get the spam. Is there any way to
deal with this? I imagine it's hard to distinguish that type of bounce from a
legitimate acknowledgement by a human being, particularly if that MTA doesn't
use an empty envelope sender in its bounces (which I've seen).

> I had my problems finding a good way to document the new things.
> Corrections, improvements are appreciated.

Perhaps you could provide a bullet-point list of the benefits of using
qconfirm-inject:

* Automatically handle confirmation requests.
* Reject bounces to your public e-mail address, to prevent receiving spam from
  empty envelope senders and to avoid bounces for mail you never sent.
* etc.

Chris