Re: [vps-mail] Blacklisting Mailer-Daemon

[Scott Wiersdorf <scottw@xxxxxxxxxxxx>]

On Thu, Nov 10, 2005 at 09:40:24AM -0700, Jonathan Duncan wrote:
> Ah, now that looks like a good bit of information.  Does this ^FROM_DAEMON 
> macro work on all the different variations of postmaster bounces?  (eg 
> postmaster, mailer-daemon, Mailer-Daemon, MAILER-DAEMON, etc.)  If so, 
> that is the solution for me!  Thank you Scott!

See the MISCELLANEOUS section of procmailrc(5):

       If the regular expression contains `^FROM_DAEMON' it will be substitut-
       ed by `(^(Mailing-List:|Precedence:.*(junk|bulk|list)|To: Multiple
       recipients of |(((Resent-)?(From|Sender)|X-Envelope-From):|>?From
       )([^>]*[^(.%@a-z0-9])?(Post(ma?(st(e?r)?|n)|office)|(send)?Mail(er)?
       |daemon|m(mdf|ajordomo)|n?uucp|LIST(SERV|proc)|NETSERV|o(wner|ps)
       |r(e(quest|sponse)|oot)|b(ounce|bs\.smtp)|echo|mirror|s(erv(ices?|er)
       |mtp(error)?|ystem)|A(dmin(istrator)?|MMGR|utoanswer))(([^).!:a-
       z0-9][-_a-z0-9]*)?[%@>\t ][^<)]*(\(.*\).*)?)?$([^>]|$)))', which should
       catch mails coming from most daemons (how's that for a regular
       expression :-).

You can work that out if you want, but it catches almost everything
bouncy-looking.

> This is indeed a joe-job (assuming the definition of joe-job is that a 
> spammer sent out a billion e-mail messages with my customers e-mail 
> address in the from).  I am a big supporter of SPF, but I have not 
> implemented it yet as I had some implementation concerns.  Do you have any 
> good SPF tips? 

Good SPF tips? Not really; it's pretty much on or off (w/ some simple
options). There are other similar mechanisms available also: domain
keys, etc. that you might want to look at (they can be used together).

Scott
-- 
Scott Wiersdorf
scottw@xxxxxxxxxxxx
======================================================================
This is <vps-mail@xxxxxxxxxxxx>       <http://www.perlcode.org/lists/>
Before posting a question, please search the archives (see above URL).