Re: Do we need a Joe job bounce message blacklist?

2005-06-01 Thread Matthew S. Cramer
On Mon, May 30, 2005 at 11:48:53AM -0400, Kevin Peuhkurinen wrote: Matthew S. Cramer wrote: If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject the mail with a 554 and Bounced

Re: Do we need a Joe job bounce message blacklist?

2005-05-30 Thread Kevin Peuhkurinen
Matthew S. Cramer wrote: If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject the mail with a 554 and Bounced message did not originate here. I was intrigued by this idea and

Re: Do we need a Joe job bounce message blacklist?

2005-05-30 Thread mazieres
On 5/27/05, Justin Mason [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Steve Prior writes: My domain geekster.com has been Joe jobbed for the last couple of weeks. In spite of the fact that I responsibly created SPF records for my domain, I am getting flooded

Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steve Prior
My domain geekster.com has been Joe jobbed for the last couple of weeks. In spite of the fact that I responsibly created SPF records for my domain, I am getting flooded with bounce messages from other mail systems that don't understand most spam from addresses are forged. Fortunatly AOL seems

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Matthew S. Cramer
On Fri, May 27, 2005 at 12:16:52PM -0500, [EMAIL PROTECTED] wrote: I think this is an awesome idea! I hate getting stupid emails about how my spam or virus was rejected from someone I've never heard of. I can't very well be sending out Outlook viruses from a Linux box! Its just adding

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steven Dickenson
Matthew S. Cramer wrote: If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject the mail with a 554 and Bounced message did not originate here. This has eliminated all the bogus

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Justin Mason
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Steve Prior writes: My domain geekster.com has been Joe jobbed for the last couple of weeks. In spite of the fact that I responsibly created SPF records for my domain, I am getting flooded with bounce messages from other mail systems that don't

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Steve Prior
Justin Mason wrote: A BL would probably be helpful -- but sadly some *really big* networks (Earthlink's challenge-response) and companies (Fortune 500s) produce these bounces, too, so it'd have serious FP potential, since those mail relay IP addresses produce both the bounces and the legit

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Antonio DeLaCruz
Actually, you can forward viruses from a Linux box if the virus is an attachment or embedded in the message. It makes no difference what OS you are using when you send the message. Linux only protects us from the viruses that want to harm Windows. Thanks, Antonio DeLaCruz Quoting [EMAIL

Re: Do we need a Joe job bounce message blacklist?

2005-05-27 Thread Dan Hollis
On Fri, 27 May 2005, Matthew S. Cramer wrote: You could probably do this with a SA rule. I do it with MIMEDefang milter. If an email is from or MAILER-DAEMON then I check the mail for a line that looks like /^Received.*one.of.our.ip.addresses/. If it doesn't have the line, then I reject