Re: How to block usurpated address return path ?

At 15:01 28/06/2004 +0100, you wrote:
>Hi Didier, on Mon, 28 Jun 2004 15:23:09 +0200 you wrote:
>
> > We are seeing an increasing number of error messages (wrong address,
> > virus, etc...) coming back to somebody who has not sent the incriminated
> > message in the first place.
>
>The general bounce problem is difficult to solve. If the user in question
>always sends messages through the same server, then you could consider
>looking for that server name in the Received: headers in the bounce.
>However, the format of bounce messages varies considerably and some don't
>even include the original headers, though most do.

Yes, it meets what I observed. I just wondered if someone had a miracle 
trick I didn't think of ;-)

I thought about registering the legitimate SMTP servers, but it's difficult 
to keep on tracking them, since some people use several of them, depending 
on where they are, and there is quite an important proportion of changes 
regarding people's internet connections.


>For the specific problem of generated "you sent us a virus"-type
>accusations, you might find my SpamAssassin blacklist helpful, as it
>catches an awful lot of these:
>
>http://www.timj.co.uk/linux/sa.php
>
>Tim

Thanks. Your bogus-virus-warnings.cf will help anyway in blocking most of 
those.


--
Didier Lebrun
Le bourg - 81140 - Vaour (France)
tél: 05.63.53.73.41 (AM et soirée)
mailto:[email protected] (MIME, ISO latin 1)
http://didier.quartier-rural.org/