Re: How to block usurpated address return path ?

Hi Didier, on Mon, 28 Jun 2004 15:23:09 +0200 you wrote:

> We are seeing an increasing number of error messages (wrong address,
> virus, etc...) coming back to somebody who has not sent the incriminated
> message in the first place.

The general bounce problem is difficult to solve. If the user in question
always sends messages through the same server, then you could consider
looking for that server name in the Received: headers in the bounce.
However, the format of bounce messages varies considerably and some don't
even include the original headers, though most do.

For the specific problem of generated "you sent us a virus"-type
accusations, you might find my SpamAssassin blacklist helpful, as it
catches an awful lot of these:

http://www.timj.co.uk/linux/sa.php

Tim