, 2004 12:48
PM
Subject: RE: [Declude.JunkMail] Fake IP
Test
Hi
Todd:
It's
this line that the other test is checking:
Received: from 65.16.167.134 ([211.249.122.134])
It
discovers that the other side was using YOUR servers IP address in its own
HELO string
: Friday, July 02, 2004 10:39
AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail]
Fake IP Test
Thanks,
I added this filter last night and I am
seeing good results. I have it weighted at 50% of my hold weight with a
COPYTO my email so I can monitor it.
Todd
Jovanovic
To: [EMAIL PROTECTED]
Sent: Friday, July 02, 2004 10:24
AM
Subject: RE: [Declude.JunkMail] Fake IP
Test
I created a
ForgedHELO.txt test and put my servers IP address in
it:
HELO 40 CONTAINS
205.150.108.8
I am deleting at
WEIGHT40
If I
Of Todd
Sent: Friday, July 02, 2004 11:57
AM
To: [EMAIL PROTECTED]
Subject: Re: [Declude.JunkMail]
Fake IP Test
I have and entry in the filter for each of the IPs in my
block. I want to monitor the results over the weekend before I start
holding email soley on the outcome of a single test. Just
Title: Message
Todd, in addition
to checking for your own IP address in the inbound mail HELO, another handy
"anti-spoofing" test is to check for your own mailhost.
HEADERS 20
CONTAINS Received: from yourmailhost.yourdomain.com
because, hey,
your mailserver is receiving this message, so
Title: Message
Hi
Todd:
It's
this line that the other test is checking:
Received: from 65.16.167.134 ([211.249.122.134])
It
discovers that the other side was using YOUR servers IP address in its own HELO
string.
I'm
pretty certain that the "HELOVALID" test in declude will catch that.
HELO 4STARTSWITH [
You do not want to apply weight if the HELO string is an IP address the helo
string being in the format of [xxx.xxx.xxx.xxx] is a vaild helo as long as
it is the ip address of the sending server.
HELO 8STARTSWITH 65.16.167.
I would definitly suggest doing
, July 01, 2004 2:42 PM
Subject: RE: [Declude.JunkMail] Fake IP Test
HELO 4STARTSWITH [
You do not want to apply weight if the HELO string is an IP address the
helo
string being in the format of [xxx.xxx.xxx.xxx] is a vaild helo as long as
it is the ip address of the sending server
Title Group
-
- Original Message -
From: "Kevin Bilbee" [EMAIL PROTECTED]
To: [EMAIL PROTECTED]
Sent: Thursday, July 01, 2004 2:42 PM
Subject: RE: [Declude.JunkMail] Fake IP Test
HELO 4STARTSWITH [
You do not want to apply weight if the HELO strin
