Re: Need help solving a Sender/From address dilemma

On 26 Apr 2010, at 21:06, Russell Robinson wrote:
> I have whitelisted *@amazon.com.
> 
> I'm now receiving spam with these headers:
> 
> Return-path: <some-real-address@some-real-domain>
> From: "Amazon.com Email Subscriptions" <[email protected]>
> 
> The return-path is a random valid email address, which has nothing to do with amazon.com.

"Deal of the day"?  Yeah, seems to be the going spam.

> Ideas I've had:
> 
> 	• Get Exim to match the Return-path domain with the From domain. Not a good idea, because they are often legitmately different.
> 	• Get TMDA to only check the Return-path address against the white list. Also, not a good idea because a legitimate whitelisted sender's server might send the email with an unrelated return-path.
> 	• Implementing Sender Policy Framework checking in Exim would stop this, but not every legitimate email sender uses SPF.
> 
> I'm stumped....
> 
> Does anyone have any suggestions on how to deal with this?

Of course, if the Amazon account is yours, the answer is TMDA's sender or keyword addresses.  You can then use rules to discard the obvious forgeries, making certain they aren't in your whitelist (which is matching the headers as well as the envelope).

Otherwise, you're left with SenderID/SPF/hand-maintained rules in your MTA and/or TMDA configuration that try to identify spoofed mail.  I used to maintain such rules in Maildrop because this isn't the sort of filtering TMDA is conducive to.  You can put Maildrop in front of TMDA, and then filter out the nonsense.  Or if Exim's pattern matchers with PCRE will let you reject it at SMTP time, that is best.

Cheers,
Sabahattin

------------------------------------------------------------------------------

_______________________________________________
tmda-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tmda-users