Re: AW: Exiscan: notifications?

Rich at Whidbey Telecom said:
> On Dec 20, 2004, at 10:32 AM, Steffen Heil wrote:
>
>> And you should never accept a virus, you should deny it.
>
> Please do not put a "deny" in your Exim configuration.  That will
> produce a bounce to the impersonated sender.
>
> You must accept viruses because the sender is forged.  Otherwise, you
> will be bouncing them back to an innocent party.

A deny only denies the receipt of the message, meaning you never accepted
the message to even look at what the From user was.  Normally, this does
not produce a "bounce" since the connecting server IS the virus infected
box.  They just drop the message and try the next combination.

If you are doing this check after one of your other servers has accepted
it however, you want to either discard or do what you did below since that
would generate a bounce.

> Instead, use "warn" to tag the message. Then, use a router to deliver
> the message into quarantine. For example:

Collecting hundreds of thousands of virus laden mail to put into
quarantine?  What would you do with it then.  What is the point?

Just deny it outright and never let it into your mail stream.  Keep your
resources for real mail.

We do the same thing with overly high scoring spam.  Deny it outright.