Scott,
We are seeing a case where the mail server will connect to itself. Check out the DNS
for this spammer's domain: hotoptions.net
It has no MX record, but an A record pointing to: 127.0.0.1
If an email from this domain is bounced due to a full mailbox, this will cause Imail
to attempt to deliver the email to 127.0.0.1 which causes a mail loop. After 5 loops
Imail kills it.
Is there a Declude test we can use to block these based on the MX/A that the domain
name resolves to?
If not, perhaps the MAILFROM test could be modified to count this as a bad domain.
Bill
-----Original Message-----
From: "R. Scott Perry"
Sent: Wed, 12 Mar 2003 18:17:33 -0500
Subject: Re: [Declude.JunkMail] HELO contains
>SOO.. My question is this.. Could I create a wordfilter rule that
>goes like
>HELO 10 CONTAINS imail.fament.com
>or will that shoot myself in the foot for some reason ?
That will work fine, just so long as you don't have any other mailservers
that identify themselves as "imail.fament.com". If your IMail server is
the only one that does, the filter will work fine.
>If it really is the HELO string then I don't see this as a problem
>since my understanding is that my mail server do NOT connect to itself
>and should then never send the helo imail.fament.com to itself ?!
Correct. There might be odd cases where the IMail server would connect to
itself, but if that happens, you've got another problem on your hands (as
it would cause a mail loop).
-Scott
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
---
This E-mail came from the Declude.JunkMail mailing list. To
unsubscribe, just send an E-mail to [EMAIL PROTECTED], and
type "unsubscribe Declude.JunkMail". The archives can be found
at http://www.mail-archive.com.
