We use IMail 7.15 on a static IP (in fact we have a block of static IPs) from MPower, but they will not delegate or customize the RDNS entries for any customers. As I know from many previous threads, this is VERY common among ISPs. Not having an RDNS entry is a very reliable measure of SPAM, but if it exists, the text of the entry is not reliable.
This is why I suggest not giving the type of RDNS entry much credibility, but certainly check if the RDNS exists!! Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of marc catuogno Sent: Monday, March 29, 2004 9:30 AM To: [EMAIL PROTECTED] Subject: RE: [HOLD weight]RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Actually your e-mail did hit my hold weight... maybe I should lower those rev DNS weights I just put in.. Are you using Charters SMTP or your own? -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Todd Holt Sent: Monday, March 29, 2004 12:22 PM To: [EMAIL PROTECTED] Subject: [HOLD weight]RE: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I also forgot to mention that I can't contact Adrian to arrange a whitelist (should any of our users need to send to his users) because my messages will be blacklisted. Todd Holt Xidix Technologies, Inc Las Vegas, NV USA 702.319.4349 www.xidix.com -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Adrian Hauri Sent: Sunday, March 28, 2004 6:30 PM To: [EMAIL PROTECTED] Subject: Re: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) Our company blocks everything with reverse DNS entry from *.client.comcast.net, *.rr.com, *.du.shawcable.net, *.eastlink.ca, *.client.attbi.com, *client2.attbi.com, *cable.wanadoo.nl, *.de.comcast.net, *.md.comcast.net, *.tn.comcast.net, *.va.comcast.net, *.ipt.aol.com, *.east.verizon.net, *.vie.surfer.at, *.sprint-hsd.net, *cable.wanadoo.nl etc. Additionallly we block everything with *-number-* (like -26-), *.number.*, *.cable.*, *.pp.*, *.ip.*, *modem*, *async*, *rback*, *dyn*, *dhcp*, *ppp*, *dial*, *dsl* in the reverse DNS. This blocks a lot of unwanted emails. It is rare that a reverse DNS entry of a legal mailserver has dsl in the name. We just had one reverse DNS entry that we had to whitelist: mailservers for swiftdsl.com.au. But it helped us to minimize the rbl lookup and speed up the mail processing. There were some people who rang us up because they got the bounce message but all of them didn't have a proper reverse DNS entry for their mailserver. It's up to you how strict you are with blocking emails. But because we do not run a mail service for a lot of clients we can apply strict rules. Adrian ------------------------------------------------- ToadShow Pty Ltd phone: 07 3004 7900 fax: 07 3846 1220 email: [EMAIL PROTECTED] http://www.toadshow.com.au ------------------------------------------------- ----- Original Message ----- From: marc catuogno To: [EMAIL PROTECTED] Sent: Monday, March 29, 2004 9:32 AM Subject: [Declude.JunkMail] FW: %RND_SUBJECTS (This worries me!) I just got this e-mail and I just feel like someone is targeting my domain for a spam campaign. When I hit view source, it only said "test". Any suggestions on how to block this?? I'm surprised that DUL or DYNA didn't catch this at all, looks like it came in though a dynamic Comcast IP not one of their SMTP servers. I put "prod-infinitum.com" into the declude header filter with enough weight to hold it, but I don't think that would be enough. Thanks - Marc -----Original Message----- From: Shella Arrington [mailto:[EMAIL PROTECTED] Sent: Sunday, March 28, 2004 5:10 AM To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS test Headers: Received: from c-24-13-168-241.client.comcast.net [24.13.168.241] by mail.prudentialrand.com (SMTPD32-8.05) id AED14440132; Sun, 28 Mar 2004 17:16:49 -0500 Received: from 18.104.180.255 by 24.13.168.241; Sun, 28 Mar 2004 11:13:22 +0100 Message-ID: <[EMAIL PROTECTED]> From: "Shella Arrington" <[EMAIL PROTECTED]> Reply-To: "Shella Arrington" <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: %RND_SUBJECTS Date: Sun, 28 Mar 2004 13:10:22 +0300 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="--0825904990538747225" X-Mailer: PIPEX NetMail 2.2.0-pre13 X-IP: 221.134.57.232 X-IMAIL-SPAM-VALFROM: (71565618) X-RBL-Warning: NOABUSE: "Not supporting [EMAIL PROTECTED]" [2-18-9000] X-RBL-Warning: NOPOSTMASTER: "Not supporting [EMAIL PROTECTED]" [2-19-9800] X-RBL-Warning: IPNOTINMX: [2-25-c800] X-RBL-Warning: CMDSPACE: Space found in RCPT TO: command . [2-32-10000] X-Declude-Sender: [EMAIL PROTECTED] [24.13.168.241] X-Declude-Spoolname: D4ed1044401323a46.SMD X-Note: This E-mail was scanned by Declude JunkMail (www.declude.com) for spam. X-Spam-Tests-Failed: NOABUSE, NOPOSTMASTER, IPNOTINMX, NOLEGITCONTENT, CMDSPACE [9] X-Country-Chain: X-Note: This E-mail was sent from c-24-13-168-241.client.comcast.net ([24.13.168.241]). X-RCPT-TO: <[EMAIL PROTECTED]> Status: U X-UIDL: 380366455 --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail scanned for viruses by Declude Virus] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com. --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail scanned for viruses by Declude Virus (http://www.declude.com)] --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type "unsubscribe Declude.JunkMail". The archives can be found at http://www.mail-archive.com.
