Re: whitelist on Reply-To:

On Fri, 9 Feb 2007, Mark Horn wrote:

> I still think it's a mistake to auto-whitelist your own domain.
> I've seen this kind of spam:
> 
> 	Envelope sender: [email protected]
> 	Envelope recipient: [email protected]
> 	From: [email protected]
> 	To: [email protected]
> 
> If I have *@mydomain.dom whitelisted, it's going to get through.
> But if I only have specific users in my domain whitelisted, then
> it's much harder for a spammer to guess who gets to get in.
> 
> I think you can resolve a lot of this problem by not
> auto-whitelisting your domain.

Agreed. I stopped whitelisting the entire domain years ago.
But I do have all the valid user accounts in a company wide whitelist
and a cron job that maintains it.

-- 
Tim Rice				Multitalents	(707) 887-1469
[email protected]