Our company blocks everything with reverse DNS entry from *.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca, *.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl, *.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net, *.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net, *cable.wanadoo.nl etc.
Additionallly we block everything with *-number-* (like -26-), *.number.*, *.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*, *dial*, *dsl* in the reverse DNS. This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of a legal mailserver has dsl in the name. We just had one reverse DNS entry that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us to minimize the rbl lookup and speed up the mail processing. There were some people who rang us up because they got the bounce message but all of them didn't have a proper reverse DNS entry for their mailserver. It's up to you how strict you are with blocking emails. But because we do not run a mail service for a lot of clients we can apply strict rules. Adrian ------------------------------------------------- ToadShow Pty Ltd phone: 07 3004 7900 fax: 07 3846 1220 email: [EMAIL PROTECTED] http://www.toadshow.com.au ------------------------------------------------- ----- Original Message ----- From: marc catuogno To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 9:32 AM Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I just got this e-mail and I just feel like someone is targeting my domain for a spam campaign. When I hit view source, it only said "test". Any suggestions on how to block this?? I'm surprised that DUL or DYNA didn't catch this at all, looks like it came in though a dynamic Comcast IP not one of their SMTP servers. I put "prod-infinitum.com" into the declude header filter with enough weight to hold it, but I don't think that would be enough. Thanks - Marc -----Original Message----- From: Shella Arrington [mailto:[EMAIL PROTECTED] Sent: Sunday, March 28, 2004 5:10 AM To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS test Headers: Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by mail.prudentialrand.com (SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500 Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Shella Arrington" <[EMAIL PROTECTED]> Reply-To: "Shella Arrington" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS Date: Sun, 28 Mar 2004 13:10:22 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--0825904990538747225" X-Mailer: PIPEX NetMail 2.2.0-pre13 X-IP: 221.134.57.232 X-IMAIL-SPAM-VALFROM: (71565618) X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000] X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800] X-RBL-Warning: IPNOTINMX: [2-25-c800] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-10000] X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241] X-Declude-Spoolname: D4ed1044401323a46.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, CMDSPACE [9] X-Country-Chain: X-Note: This E-mail was sent from c-24-13-168-241.client.comcast.net ([24.13.168.241]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 380366455 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
