From: Victor Duchovni (no email)
Date: Mon Oct 01 2007 - 11:44:05 EDT
On Mon, Oct 01, 2007 at 09:49:33AM -0500, KashMaster wrote:
> This question seems to have been answered many times and in various
> ways... in fact, so often that there is such an overabundance that it
> is difficult to winnow the wheat from the chaff. Consequently, I am
> seeking your opinions both in general and specifically with regard to
> postfix.
>
> To expand on the subject line: I was greeted (?) this morning by a
> mailbox of several thousand "mail failure" notices from servers all over
> the world. Without exception, these represented rejected spam (either
> caught by a spamguard or sent to a bad address) that had various
> non-existent return addresses at one of my domains.
>
> These were forwarded to a specific mailbox which I set up for unknown
> recipients... seemed like a good idea at the time, but obviously there
> are drawbacks.
Yes, strongly consider removing the wildcard mailbox, and reject invalid
addresses.
> No doubt the general subject lines can be filtered (and in fact, as this
> has happened before, a few thousand of them were filtered to "rejected"
> mailbox),
http://www.postfix.org/BACKSCATTER_README.html
> but the more important question to my mind is whether there is
> something better (or additional) to do that would let the sender know
> that the return address was faked and did not originate from this domain?
What sender? You are getting bounces. For out of office replies,
... don't contribute to the spam recipient's junk mail load by sending
further email they did not want.
-- Viktor. Disclaimer: off-list followups get on-list replies or get ignored. Please do not ignore the "Reply-To" header. To unsubscribe from the postfix-users list, visit http://www.postfix.org/lists.html or click the link below: <mailto:?body=unsubscribe%20postfix-users> If my response solves your problem, the best way to thank me is to not send an "it worked, thanks" follow-up. If you must respond, please put "It worked, thanks" in the "Subject" so I can delete these quickly.
|
|
|