Re: Fwd: failure notice

On Fri, 2005-05-13 at 16:03 -0700, Steve Pirk wrote:
> On Fri, 13 May 2005, Paul Howarth wrote:
> 
> > Simon Shapiro wrote:
> > > You realize this flew right over my head.  Right?
> > > I apologize, but what is "qmail backscatter" ?
> >
> > qmail by default accepts all incoming mail and sends bounces for
> > undeliverable addresses. Given the amount of forged/spoofed mail on the
> > Internet now as a result of worms and spammers, this behaviour is no
> > longer acceptable on the Internet, as it results in sending non-delivery
> > reports to people that did not originate messages. This is called
> > "backscatter". The proper way to handle this is to reject the mail
> > in-protocol rather than accepting and then bouncing the message to the
> > purported sender.
> >
> > See also: http://www.techzoom.net/paper-mailbomb.asp
> >
> > Paul.
> >
> 
> I understand the implications of bouncing messages back to
> the sender, as I receive a lot of them. I read the above article
> but it did not point to ways/resources to configure your MTA to
> not do this. Does anyone have a link to some config tips? I am
> currently using sendmail and it does indeed bounce everything
> back to the sender. Google is not returning much except to add
> a FEATURE like virtusertable. Maybe something like:
> 
> [email protected]	valid1 # valid user
> [email protected]	valid2 # valid user
> @domain.com		reject:nouser 550 No such user here
> 
> Thanks for the tip Paul!

sendmail rejects mail in-protocol, it doesn't accept-then bounce.
Unless, that is you have some sort of forwarding arrangement, such as a
backup MX or a "firewall" MTA, which accepts all mail and then forwards
it to an internal LAN mail server for delivery. In that case, the
internal mail server will reject mail in-protocol for undeliverable
mail, and the backup MX or firewall MTA will generate a bounce and send
it to the forged sender address.

Here's a way of testing it, if you have multiple email accounts (let's
call them A, B, and C) you can use. "Forge" a mail at A to look like it
came from B and send it to C. If A gets the "bounce", then C is
rejecting mail properly. If B gets it, C has backscatter issues. If C's
domain has multiple MX records, try all of them.

If for some reason you feel that you really need multiple MXes for a
domain, they should all have the same anti-spam defences and they should
should all know the list of valid accounts for the domain. That should
prevent *most* backscatter (you might still get bounces for over-quota
accounts etc.).

Paul.
-- 
Paul Howarth <[email protected]>


----------------------------------------------
This message was sent to the opt-in DSBL list.
If you do not want to receive DSBL messages,
please send mail to [email protected].