Hey Scott, Got another one for you. Check out the DNS for this spammer's domain: e247.com
The MX points to "localhost". The MAILFROM test does not catch this yet, but probably should. Bill -----Original Message----- From: "R. Scott Perry" Sent: Thu, 13 Mar 2003 10:34:41 -0500 Subject: Re: [Declude.JunkMail] HELO contains >We are seeing a case where the mail server will connect to itself. Check >out the DNS for this spammer's domain: hotoptions.net > >It has no MX record, but an A record pointing to: 127.0.0.1 > >If an email from this domain is bounced due to a full mailbox, this will >cause Imail to attempt to deliver the email to 127.0.0.1 which causes a >mail loop. After 5 loops Imail kills it. > >Is there a Declude test we can use to block these based on the MX/A that >the domain name resolves to? > >If not, perhaps the MAILFROM test could be modified to count this as a bad >domain. The MAILFROM test will detect this in the next release. :) -Scott --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.