Topic: Reverse DNS on Email

[Cyrus]

Hello,

I have been searching around the forums for a bit looking through threads but cant seem to find a definative answer.

Problem:
We are being hammered by a person who is infected with NetSky, see example header below:

Return-Path: <sam@engr.sgi.com>
Delivered-To: maillog@ms04.langs.net.au
Received: (qmail 12924 invoked by alias); 26 Jul 2004 00:33:24 -0000
Delivered-To: alias-localdelivery-maillog@langs.net.au
Received: (qmail 12907 invoked from network); 26 Jul 2004 00:33:24 -0000
Received: from rdlax12-b234.dialup.optusnet.com.au (HELO langs.net.au) (198.142.42.234)
  by ms04.langs.net.au (xxx.xxx.xxx.xxx) with ESMTP; 26 Jul 2004 00:33:08 -0000
From: sam@engr.sgi.com
To: rachael@langs.net.au
Subject: Re: Your picture
Date: Mon, 26 Jul 2004 10:32:52 +1000
MIME-Version: 1.0
Content-Type: multipart/mixed;
   boundary="----=_NextPart_000_0006_00005FAD.000026FB"
X-Priority: 3
X-MSMail-Priority: Normal
X-BitDefender-Scanner: Clean, Agent: Qmail 1.5.6 (ms04)


Everyday we recieve about 100 or so of these. Now we are running BitDefender and it works fine, but I would like to put something infront of BitDefender so that it looks to see that the from address is the same as the originating server, in this case it always come from a different IP/host but it always has the end of the address end in dialup.optusnet.com.au.

I have emailed Optus and complained but have not seen any action, nor do I expect it.

So any suggestions how to stop this?

Thanks for your time!

Cyrus Bharda

[raem]

Not what you are asking for, but the Pattern Matching contrib will reject all those type of messages with infected attachments. You will need to be running v6.0 or better (not beta). This contrib (and a couple of others) is reason enough to upgrade if you have not already done so. See

http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/Virus%20and%20file%20blocking%20HOWTO%20using%20smtpfront-qmail%20for%20sme%20server.htm

[Cyrus]

Hey Ray,

Long time no see, still providing great help and support to noobs I see

Anyway yeah I am using v6.0.1 so will give that a go, thanks! Only problem I see is that I do not want to upset BitDefender which we already use, and was hoping for somthing simple, hey does ASSP do reverse dns'ing?

[raem]

I'm not sure if ASSP would work OK with Pattern Matching, possibly not as ASSP redirects the incoming mail to itself. See a recent post for details.

Users have reported that ASSP uses RBL and is not compatible with the other RBLList Spam blocking outlined in this HOWTO

http://mirror.contribs.org/smeserver/contribs/rmitchell/smeserver/howto/Spam%20blocking%20HOWTO%20using%20smtpfront-qmail%20for%20sme%20server.htm

My guess is that ASSP is NOT a good choice if you want to implement the methods outlined in either of my Spam or Virus blocking HOWTO's