>   Just kidding -- but I almost always
>receive your answers to everyone's questions before I receive the
>original questions!  (Actually, I'll probably get the answer to this as
>soon as I hit "send".  You guys are great!)

ha, our messages crossed!


>My question:  I have a user who has a list of clients.  When she needs
>to send out a mass email, she runs a query that selects a subset of the
>entire list, and sends out the email.  After mailing, she receives some
>bounce messages from addresses that she didn't send to.

people do lotsa forwarding, drives my list owners nutz when some irate 
recipient can't remember under what address they subscribed and which 
forwards the unwanted dirty joke message to the mailbox they read it from.

>   I'm assuming
>these are from people who have their emails forwarded to another
>account, and that second account is now bad.

stuff like that.

>   Other than resorting to
>sending smaller and smaller groups of emails out to narrow down the
>problems, does anyone have any ideas on how I can determine which of her
>original email addresses are the ones that are causing the bounces?

all you can do is look at the delivery headers of the bounced message and 
see where it has been, the lookup those domains in your mailing list.  This 
does not always work.

>   I
>haven't been able to find anything in the headers that will help me
>(possibly because we're still using version 4 of IMail . . .).  I'm not
>really expecting any easier way, but I'm hoping!

no, you're on the only track of data you have.

>On a side note, I noticed something interesting in my logs today:
>   [208.11.217.254] connect 152.163.224.70 port 50211
>   [152.163.224.70] HELO Open_Relay_Test_ort-r01.mail.aol.com
>   [152.163.224.70] MAIL FROM: <[EMAIL PROTECTED]>
>   [152.163.224.70] RCPT TO: <[EMAIL PROTECTED]>
>   [152.163.224.70] ERR clinres.com invalid user

we need to see the Win32 PID's.  adjacent log lines aren't necessarily in 
the same SMTP/D session.

of course, all the above headers could be forged. but 152.163.224.70 is an 
aol ip.

Interesting that AOL is bothering to test for open relays.  But considering 
their resources, and considering what must be a god-awful mail abuse problem...

Len


http://MenAndMice.com/DNS-training
http://BIND8NT.MEIway.com : ISC BIND for NT4 & W2K
http://IMGate.MEIway.com  : Build free, hi-perf, anti-abuse mail gateways


Please visit http://www.ipswitch.com/support/mailing-lists.html 
to be removed from this list.

An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/

Reply via email to