Re: whitelist on Reply-To:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Mark Horn wrote:
> I still think it's a mistake to auto-whitelist your own domain.
> I've seen this kind of spam:
> 
> 	Envelope sender: [email protected]
> 	Envelope recipient: [email protected]
> 	From: [email protected]
> 	To: [email protected]
> 
> If I have *@mydomain.dom whitelisted, it's going to get through.
> But if I only have specific users in my domain whitelisted, then
> it's much harder for a spammer to guess who gets to get in.
> 
> I think you can resolve a lot of this problem by not
> auto-whitelisting your domain.

That's a good point.

I try to detect and reject that kind of thing in the MTA though, because
then the email is never accepted for processing by my system, and hence
I never have to hold/challenge it, nor virus/spamassassin/... check it
etc. This uses much fewer of my system's resources!
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.2 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFFzKDGhk3bo0lNTrURAs2UAKDsRdQ7Rj8kehdBcfEAbDSiXn0IHwCg0jN9
BI6j2Q1+jg+setwYJIV4ZQk=
=pdIN
-----END PGP SIGNATURE-----