>However, with the particular SPAM below (see header info below), the sender
>appears to be faking out Declude with a false e-mail account on our domain
>name
>([EMAIL PROTECTED]). That's not our IP and was wondering if there
>is a way to block?
Although Declude JunkMail can check the return address to make sure that it
is a valid domain, it is not normally possible to detect an invalid username.
Note, however, that Declude JunkMail will not get tricked into thinking
that the mail is legitimate just because the sender used a return address
on your domain.
>We have smtp set-up for relay only our machine IP addresses.
That won't affect this -- the relay settings only prevent unauthorized
outgoing mail. Even the strictest relay settings will allow anyone to send
as much mail as they want to local users.
>Received: from ns.kayakuakzo.co.jp [210.154.131.210] by
>SNEEZY.XEROCOM.NET with ESMTP
> (SMTPD32-6.00) id AF1B241F009C; Sun, 06 Jan 2002 16:18:19 -0500
>Received: from 123.net (localhost [127.0.0.1])
> by ns.kayakuakzo.co.jp (8.9.3/8.9.3) with ESMTP id GAA15615
> for <[EMAIL PROTECTED]>; Mon, 7 Jan 2002 06:13:11 +0900
>Date: Mon, 7 Jan 2002 06:13:11 +0900
>From: [EMAIL PROTECTED]
>Message-Id: <[EMAIL PROTECTED]>
>To: [EMAIL PROTECTED]
>Reply-To: [EMAIL PROTECTED]
>Subject: A Free Report for You!
>Content-type: text/html
>MIME-Version: 1.0
... and the headers of the E-mail are all legitimate headers, and none are
considered "spam-like'", so it wouldn't fail the SPAMHEADERS/BADHEADERS tests.
Note that the E-mail was sent from 210.154.131.210, which is listed in
about a half dozen DNS-based anti-spam databases, including SPAMCOP (which
catches a very high percentage of spam).
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
