Re: Getting hammered by backscatter

2008-11-13 Thread Michelle Konzack
Am 2008-11-07 21:27:17, schrieb Benny Pedersen: > how can anyone solve anything when postmasters cant talk together ? IF there are legitimate "postmaser" messages from serious domains, they will go throuh... But I do not like to kommunicate with postmaster from domains bombing me. Please note,

Re: Getting hammered by backscatter

2008-11-08 Thread mouss
Benny Pedersen wrote: On Fri, November 7, 2008 19:31, mouss wrote: postmaster@ so Michell said she rejects mail from postmaster@ from specific clients. http://rfc-ignorant.org/policy-postmaster.php you cited rfci which is irrelevant here. the rfci policy applies to postmaster as a recip

Re: Getting hammered by backscatter

2008-11-07 Thread Sahil Tandon
Benny Pedersen <[EMAIL PROTECTED]> wrote: > On Fri, November 7, 2008 19:31, mouss wrote: > > >>> postmaster@ > >> http://rfc-ignorant.org/policy-postmaster.php > > the rfci policy applies to postmaster as a recipient. nobody can force > > you to accept mail _from_ postmaster. > > how can anyone

RE: Getting hammered by backscatter

2008-11-07 Thread RobertH
> how can anyone solve anything when postmasters cant talk together ? > > doh > > > -- > Benny Pedersen > *snip* advertisement and link benny, do you trust emails from some postmaster at some domain and spend lots of time answering them? yeah, right. and btw benny, please stop spamming us

Re: Getting hammered by backscatter

2008-11-07 Thread Benny Pedersen
On Fri, November 7, 2008 19:31, mouss wrote: >>> postmaster@ >> http://rfc-ignorant.org/policy-postmaster.php > the rfci policy applies to postmaster as a recipient. nobody can force > you to accept mail _from_ postmaster. how can anyone solve anything when postmasters cant talk together ? doh

Re: Getting hammered by backscatter

2008-11-07 Thread mouss
Benny Pedersen wrote: On Fri, November 7, 2008 03:33, Michelle Konzack wrote: I am rejecting ANY (!!!) messages coming from <*.ru> and <*.ua> domains where the "From:" header is from: MAILER-DAEMON@ ok postmaster@ http://rfc-ignorant.org/policy-postmaster.php the rfci

Re: Getting hammered by backscatter

2008-11-07 Thread Benny Pedersen
On Fri, November 7, 2008 03:33, Michelle Konzack wrote: > I am rejecting ANY (!!!) messages coming from <*.ru> and <*.ua> domains > where the "From:" header is from: > > MAILER-DAEMON@ ok > postmaster@ http://rfc-ignorant.org/policy-postmaster.php > noreply@ >

Re: Getting hammered by backscatter

2008-11-07 Thread Michelle Konzack
Hi Chris. I have gotten over 200.000 of them with more then 2700 MByte... Now it is reduced to less then 200 backscatter per day. I am rejecting ANY (!!!) messages coming from <*.ru> and <*.ua> domains where the "From:" header is from: MAILER-DAEMON@ postmaster@ noreply

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-05 Thread Claude Frantz
In order to reduce backscattering, I'm using an additional milter-regex on the systems processing outgoing messages. This milter-regex try to recognize backscattered messages as well as spam marked messages redirected to addresses outside off the protected perimeter. Although this method is not

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-04 Thread mouss
Justin Mason wrote: mouss writes: Justin Mason wrote: mouss writes: [snip] will vbounce tag this message? Nope ;) hmmm. It does trigger BOUNCE_MESSAGE here (both my message and your reply): [71842] dbg: rules: ran one_line_body rule __BOUNCE_OOO_1 ==> got hit: "I will be on vacation f

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-04 Thread Justin Mason
mouss writes: > Justin Mason wrote: > > mouss writes: > >>[snip] > >> will vbounce tag this message? > > > > Nope ;) > > > > hmmm. It does trigger BOUNCE_MESSAGE here (both my message and your reply): > > [71842] dbg: rules: ran one_line_body rule __BOUNCE_OOO_1 ==> got > hit: "I will be

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-04 Thread mouss
Justin Mason wrote: mouss writes: [snip] will vbounce tag this message? Nope ;) hmmm. It does trigger BOUNCE_MESSAGE here (both my message and your reply): [71842] dbg: rules: ran one_line_body rule __BOUNCE_OOO_1 ==> got hit: "I will be on vacation from" ... [71842] dbg: rules: ran

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-04 Thread Justin Mason
mouss writes: > Andy Spiegl wrote: > > [snip] > > > > But I do agree with Karsten (or Guenther?) that we shouldn't raise the > > score. > > yes, vbounce does FP. Let's test: > > nobody wrote: > > I will be on vacation from 1/2/2345 to 6/7/8901. > > will vbounce tag this message? Nope ;) -

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread mouss
Andy Spiegl wrote: [snip] But I do agree with Karsten (or Guenther?) that we shouldn't raise the score. yes, vbounce does FP. Let's test: nobody wrote: > I will be on vacation from 1/2/2345 to 6/7/8901. will vbounce tag this message? But my problem is that I cannot explain to all of my u

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-11-03, 13:02, Bob Kinney wrote: > We set up server side filters for SPAM that users can enable or > disable, is this something you could do in your environment? Uhmmm...not easily I think. We're using a combination of postfix and AMaViS. I'd have to plug procmail inbetween somehow... Than

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Bob Kinney
Uhmm... interesting. What exactly might cause this? I tried to trigger this behaviour bouncing and forwarding mails from different accounts but never saw the __BOUNCE_RPATH_NULL tag. Might just be our mail server software. It's something we've worked around. But I do agree with Karsten (or G

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Karsten Bräckelmann
On Mon, 2008-11-03 at 15:57 +0100, Andy Spiegl wrote: > Shouldn't the vbounce ruleset help here? Yes, it does. :) > I'm asking because me and my users have the same problem and I am > currently considering giving the ANY_BOUNCE_MESSAGE a higher score > but I am not sure yet whether it's a good i

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-11-03, 10:13, Bob Kinney wrote: > but had one unfortunate side effect: E-mail forwarded from another > account to an account on our servers was considered a "bounce" > because it hit __BOUNCE_RPATH_NULL. Uhmm... interesting. What exactly might cause this? I tried to trigger this behaviou

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Bob Kinney
We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BACKSCATTER_README.html#real but still getting p

Re: Getting hammered by backscatter - possible solution: vbounce ?

2008-11-03 Thread Andy Spiegl
On 2008-10-29, 18:44, Chris Arnold wrote: > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin > built-in. At the present time, my mailbox is filled with > backscatter; getting around 10 a minute since 4:30 today. I have > postfix backscatter rules in postfix of zimbra, > http://www.postfix.

Re: Getting hammered by backscatter

2008-11-03 Thread Matthew Newton
Hi, On Wed, 29 Oct 2008, Chris Arnold wrote: > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the > present time, my mailbox is filled with backscatter; getting around 10 a > minute since 4:30 today. I have postfix backscatter rules in postfix of > zimbra, http://www.post

Re: Getting hammered by backscatter

2008-11-02 Thread Benny Pedersen
On Sun, November 2, 2008 22:18, mouss wrote: >> that rbl long ago, olso its bad to see dsn go out to remote mtas is the >> biggest problem mailerdaemons should stay local > sorry, I don't understand the last part. i explain badly sorry for that, but when mta bounces mailer daemons msg outside the

Re: Getting hammered by backscatter

2008-11-02 Thread mouss
Sahil Tandon wrote: Matthias Leisi <[EMAIL PROTECTED]> wrote: mouss schrieb: reject_backscatter = reject_rbl_client ips.backscatterer.org Which will very likely result in a lot of false positives. an FP here would mostly be: a bounce from a 3d party that is listed on backscatterer.org.

Re: Getting hammered by backscatter

2008-11-02 Thread mouss
Benny Pedersen wrote: On Sun, November 2, 2008 19:14, mouss wrote: PS. don't think SPF will help. this has been discussed here and elsewhere before. SPF helps if its used from the sites that does use spf in mta stage, if not used it will turn over to be a backscatter site itself yes, but I

Re: Getting hammered by backscatter

2008-11-02 Thread Sahil Tandon
Matthias Leisi <[EMAIL PROTECTED]> wrote: > mouss schrieb: > > >>> reject_backscatter = > >>> reject_rbl_client ips.backscatterer.org > >> > >> Which will very likely result in a lot of false positives. > > > > an FP here would mostly be: a bounce from a 3d party that is listed on > > backsc

Re: Getting hammered by backscatter

2008-11-02 Thread Benny Pedersen
On Sun, November 2, 2008 19:14, mouss wrote: > PS. don't think SPF will help. this has been discussed here and > elsewhere before. SPF helps if its used from the sites that does use spf in mta stage, if not used it will turn over to be a backscatter site itself that rbl listed sourceforge.net f

Re: Getting hammered by backscatter

2008-11-02 Thread Matthias Leisi
mouss schrieb: >>> reject_backscatter = >>> reject_rbl_client ips.backscatterer.org >> >> Which will very likely result in a lot of false positives. > > an FP here would mostly be: a bounce from a 3d party that is listed on > backscatterer.org. do you get a lot of such mail? No, an FP is an

Re: Getting hammered by backscatter

2008-11-02 Thread mouss
Matthias Leisi wrote: mouss schrieb: reject_backscatter = reject_rbl_client ips.backscatterer.org Which will very likely result in a lot of false positives. an FP here would mostly be: a bounce from a 3d party that is listed on backscatterer.org. do you get a lot of such mail?

Re: Getting hammered by backscatter

2008-11-02 Thread Matthias Leisi
mouss schrieb: > reject_backscatter = > reject_rbl_client ips.backscatterer.org Which will very likely result in a lot of false positives. -- Matthias

Re: Getting hammered by backscatter

2008-11-02 Thread mouss
Chris Arnold wrote: We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BACKSCATTER_README.html#

Re: Getting hammered by backscatter

2008-10-30 Thread Martin Gregorie
On Thu, 2008-10-30 at 10:28 -0600, Karl Pearson wrote: > On Wed, 29 Oct 2008, Chris Arnold wrote: > > > We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the > > present time, my mailbox is filled with backscatter; getting around 10 a > > minute since 4:30 today. I have postf

Re: Getting hammered by backscatter

2008-10-30 Thread Karl Pearson
On Wed, 29 Oct 2008, Chris Arnold wrote: We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BAC