RE: [Declude.JunkMail] Bouncing emails

Mon, 27 Feb 2006 13:39:45 -0800

Title: Message
How to suppress generation of NDRs in Exchange 5.5:
 
 
Andrew 8)
 
p.s. For anybody reading this who finds that they get enough spam leakage to take this step, you might also check out these very, very general tips:
 
a) Check out Message Sniffer from ARM Research Labs at http://www.armresearch.com/ for an excellent and reasonably priced message content scanner.  I believe that Declude is a reseller.
 
b) Check that your Exchange BadMail folder is a reasonable size.  Ignoring this can really kill your free disk space.  I use a simple command line script that deletes the contents on a regular basis and schedule it for every day with the "at" command.
 
c) Check that your RBLs and weightings in Declude are up to date.  For one lead, Scott Fisher posts which tests he is using and their relative quality at http://it.farmprogress.com/declude/declude.htm along with other helpful external tools and various helpful links.
 
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Colbeck, Andrew
Sent: Monday, February 27, 2006 1:12 PM
To: Declude.JunkMail@declude.com
Subject: RE: [Declude.JunkMail] Bouncing emails

Frederick, if you decide you really have to not send NDRs, then you can follow this KB article:
 
 
which tells you where in Exchange to disable sending NDRs.  What it doesn't tell you is that you can create other domains to which you can still send NDRs, for example, if you have a certain high profile domains from which you don't get spam.
 
And just to clarify, this setting in System Manager will not affect your users; if they send a message to a mis-addressed address, and the other end sends a NDR, your server will receive it and deliver it to your user.
 
In Exchange 5.5, there was a hotfix that enabled a registry entry to control the behaviour of NDR generation; I don't use 5.5 anymore, but I know that it exists.
 
Andrew 8)
 
 

From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Frederick Samarelli
Sent: Monday, February 27, 2006 12:27 PM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Bouncing emails

Is there not a way to set Exchange to accept them then trash.
----- Original Message -----
Sent: Monday, February 27, 2006 12:44 PM
Subject: Re: [Declude.JunkMail] Bouncing emails

You wouldn't. The gateway is not that smart.
 
We gave up on attempting to deliver misspelled emails when we were the subject of a distributed dictionary attack. No more than ten messages from any IP address, so nothing could catch it. We got half a million messages a day for months. The Symantec gateway software was useless in that situation.
 
Even setting the bounce period to one day still had the gateway trying to send half a million bounces.
 
-d
----- Original Message -----
Sent: Monday, February 27, 2006 12:41 PM
Subject: RE: [Declude.JunkMail] Bouncing emails

In his setup Symantec would not see the message as a bounce.
 
Anyway how would you determine a bounce form a dictionary attack as opposed to someone who just typed the email address incorrectly.
 
 
Kevin Bilbee
-----Original Message-----
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Dave Doherty
Sent: Monday, February 27, 2006 9:12 AM
To: Declude.JunkMail@declude.com
Subject: Re: [Declude.JunkMail] Bouncing emails

That is exactly why I stopped using Symantec as a gateway. I tried to get them to add a "don't send bounces" checkbox or at least a registry entry. but they refused, saying the Internet RFC's made NDRs mandatory.
 
-d
----- Original Message -----
Sent: Monday, February 27, 2006 11:50 AM
Subject: [Declude.JunkMail] Bouncing emails

I am running a filter system listed below:
 
1. Front End. Symantec SMTP Gateway. (Scan Virus and a bit of spam and extensions). Removed 80% of my problems.
2. IMAIL 8.x and Declude 2.x scan and forward service.
3. Last Stop. MS Exchange
 
The problem is when we get a dictionary attack the exchange server sends a bounce. 550 user unknown.
 
The 550's works there way back through the system and now the SMTP Gateway server attempts to deliver the bounce for a day.
 
Anyone know a way of preventing the bounce.
 
Thanks.
 
Fred
 

Reply via email to