You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by "Brian S. Meehan" <br...@meehanontheweb.com> on 2006/10/16 00:16:59 UTC
Any suggestions for 'postmaster' spams?
It appears that my email address is now being used as a from address in
many spam emails to many addresses. Over the past week, I have gotten 150+
"postmaster: mail delivery failure" -each day-.
Does anyone have suggestions on how to handle this? They're all
semi-standard 'delivery failure' or 'content blocked' notices, so I
created filtering rules based on the subjectline to put them all into a
folder. I don't think they should be marked as spam though because they're
not.
Thanks,
Brian
--
"All people who think everything is either black or white are idiots."
Re: Any suggestions for 'postmaster' spams?
Posted by Jo Rhett <jr...@netconsonance.com>.
Brian S. Meehan wrote:
> It appears that my email address is now being used as a from address in
> many spam emails to many addresses. Over the past week, I have gotten 150+
> "postmaster: mail delivery failure" -each day-.
>
> Does anyone have suggestions on how to handle this?
Yes. Implement SPF and DKIM policies to tell other sites how to
interpret your mail. Right now, implementing both is good for 70% of
the backscatter.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: Any suggestions for 'postmaster' spams?
Posted by "John D. Hardin" <jh...@impsec.org>.
On Mon, 16 Oct 2006, Jo Rhett wrote:
> John D. Hardin wrote:
> > On Mon, 16 Oct 2006, Jo Rhett wrote:
> > I am convinced that spam (in all its forms) will continue to be a
> > problem until spammers start dying for what they are doing. That will
> > change the risk/benefit analysis rather strongly towards the negative.
>
> So join WhackASpammer. You make a micropayment for each spam you
> receive from a spammer. When $50k has been reached for any given
> spammer, they are whacked. :-)
ROFL! Love it!
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
15 days until Halloween
Re: Any suggestions for 'postmaster' spams?
Posted by Jo Rhett <jr...@netconsonance.com>.
John D. Hardin wrote:
> On Mon, 16 Oct 2006, Jo Rhett wrote:
> I am convinced that spam (in all its forms) will continue to be a
> problem until spammers start dying for what they are doing. That will
> change the risk/benefit analysis rather strongly towards the negative.
So join WhackASpammer. You make a micropayment for each spam you
receive from a spammer. When $50k has been reached for any given
spammer, they are whacked. :-)
NOTE: THIS IS A JOKE. I keep meaning to register the domain and put up
a spoof site, but I haven't had the time to make sure I can't be sued
for doing this....
--
Jo Rhett
Network/Software Engineer
Net Consonance
RE: Any suggestions for 'postmaster' spams?
Posted by R Lists06 <li...@abbacomm.net>.
>
> Okay, I'll answer.
>
> I am convinced that spam (in all its forms) will continue to be a
> problem until spammers start dying for what they are doing. That will
> change the risk/benefit analysis rather strongly towards the negative.
>
> --
> John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
Either that or the powers that be will try to regulate it so that you have
to pay to license an email server and they will control *everything* about
connectivity with giant firewalls kinda like some countries already try or
do.
Whatever brings in the most money and power...
- rh
--
Robert - Abba Communications
Computer & Internet Services
(509) 624-7159 - www.abbacomm.net
Re: Any suggestions for 'postmaster' spams?
Posted by "John D. Hardin" <jh...@impsec.org>.
On Mon, 16 Oct 2006, Jo Rhett wrote:
> jdow wrote:
> > Not much you can do about it other than find a shotgun, go find the
>
> Please educate yourself before answering something like this. If
> you don't know the answer, perhaps it is best to sit quietly and
> wait for someone else to answer instead?
Okay, I'll answer.
I am convinced that spam (in all its forms) will continue to be a
problem until spammers start dying for what they are doing. That will
change the risk/benefit analysis rather strongly towards the negative.
--
John Hardin KA7OHZ ICQ#15735746 http://www.impsec.org/~jhardin/
jhardin@impsec.org FALaholic #11174 pgpk -a jhardin@impsec.org
key: 0xB8732E79 - 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the Fates notice those who buy chainsaws...
-- www.darwinawards.com
-----------------------------------------------------------------------
15 days until Halloween
Re: Any suggestions for 'postmaster' spams?
Posted by Jo Rhett <jr...@netconsonance.com>.
jdow wrote:
> Not much you can do about it other than find a shotgun, go find the
Please educate yourself before answering something like this. If you
don't know the answer, perhaps it is best to sit quietly and wait for
someone else to answer instead?
The following two technologies greatly reduce the acceptance of forged
spam, and thus reduce the backscatter too.
http://www.openspf.org/
http://mipassoc.org/dkim/
There's also a ruleset for detecting forged bouncebacks, but it needs to
be rewritten if you're hosting multiple domains. Hopefully the author
will get to that, or I might submit a patch eventually :-)
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: Any suggestions for 'postmaster' spams?
Posted by jdow <jd...@earthlink.net>.
Not much you can do about it other than find a shotgun, go find the
owner of the botnet sending the spam and the spammer generating them,
and shot the both of them in the groin. (That is to say, I know how
frustrating being on the incoming for a joejob can be. You could
also send email to the postmasters at the domains who are sending
you these failure messages and telling them that they are facilitating
spammers with their bounce messages. And if that does not work make a
procmail (or equivalent) rule to block these spam relaying domains.
Oh yes, and submit them to several block lists for good measure.
{^_^}
----- Original Message -----
From: "Brian S. Meehan" <br...@meehanontheweb.com>
> It appears that my email address is now being used as a from address in
> many spam emails to many addresses. Over the past week, I have gotten 150+
> "postmaster: mail delivery failure" -each day-.
>
> Does anyone have suggestions on how to handle this? They're all
> semi-standard 'delivery failure' or 'content blocked' notices, so I
> created filtering rules based on the subjectline to put them all into a
> folder. I don't think they should be marked as spam though because they're
> not.
>
> Thanks,
> Brian
>
>
> --
> "All people who think everything is either black or white are idiots."
Re: Any suggestions for 'postmaster' spams?
Posted by Jo Rhett <jr...@netconsonance.com>.
Benny Pedersen wrote:
> On Mon, October 16, 2006 00:16, Brian S. Meehan wrote:
>> It appears that my email address is now being used as a from address in
>> many spam emails to many addresses. Over the past week, I have gotten 150+
>> "postmaster: mail delivery failure" -each day-.
>
> is it with enveloppe from postmaster@yourdomain.tld ?
>
> if yes, make postfix reject FROM: postmaster will solve it nicely
>
> pcre_reject_no_real_user_map.pcre:
> /^postmaster@*./ REJECT Postmasters is nice
>
> main.cf:
> smtpd_sender_restrictions =
> ...
> check_sender_access pcre:/etc/postfix/pcre_reject_no_real_user_map.pcre
> ...
>
> do not make it to the recipient !
I'm not a postfix user, so clue me in. Doesn't this prevent local
bounce messages from being delivered?
I also believe that the original post was about backscatter, not forged
postmaster mail.
--
Jo Rhett
Network/Software Engineer
Net Consonance
Re: Any suggestions for 'postmaster' spams?
Posted by Benny Pedersen <me...@junc.org>.
On Mon, October 16, 2006 00:16, Brian S. Meehan wrote:
> It appears that my email address is now being used as a from address in
> many spam emails to many addresses. Over the past week, I have gotten 150+
> "postmaster: mail delivery failure" -each day-.
is it with enveloppe from postmaster@yourdomain.tld ?
if yes, make postfix reject FROM: postmaster will solve it nicely
pcre_reject_no_real_user_map.pcre:
/^postmaster@*./ REJECT Postmasters is nice
main.cf:
smtpd_sender_restrictions =
...
check_sender_access pcre:/etc/postfix/pcre_reject_no_real_user_map.pcre
...
do not make it to the recipient !
> Does anyone have suggestions on how to handle this? They're all
> semi-standard 'delivery failure' or 'content blocked' notices, so I
> created filtering rules based on the subjectline to put them all into a
> folder. I don't think they should be marked as spam though because they're
> not.
http://www.t29.dk/antiantivirus.txt
if that will not help send samples to the email on this page
> "All people who think everything is either black or white are idiots."
:-)
--
"This message was sent using 100% recycled spam mails."
RE: Any suggestions for 'postmaster' spams?
Posted by R Lists06 <li...@abbacomm.net>.
>
> Uh. Yeah. Is it just me, or are all the dumb answers coming up today?
>
> Or, perhaps, run spamassassin and don't worry about changing your e-mail
> constantly? Duh?
>
> --
> Jo Rhett
> Network/Software Engineer
> Net Consonance
It's you Jo.
Yet we apologize Jo, we are all having a really difficult time trying to
live up to your standards but we are trying real hard though Jo...
- rh
--
Robert - Abba Communications
Computer & Internet Services
(509) 624-7159 - www.abbacomm.net
Re: Any suggestions for 'postmaster' spams?
Posted by Jo Rhett <jr...@netconsonance.com>.
R Lists06 wrote:
> First suggestion, don't post to list with the email address you use for biz
> or personal use.
>
> Make another and use it for all lists. When you get spammed on it, change it
> slightly, unsub the other and sub the new to all the lists you are on.
Uh. Yeah. Is it just me, or are all the dumb answers coming up today?
Or, perhaps, run spamassassin and don't worry about changing your e-mail
constantly? Duh?
--
Jo Rhett
Network/Software Engineer
Net Consonance
RE: Any suggestions for 'postmaster' spams?
Posted by R Lists06 <li...@abbacomm.net>.
> Plussed addressing helps here. I hate web forms that refuse to let me put
> a
> plus sign in my email address. (Typically a result of over-zealous input
> filtering.)
>
> I probably subscribe to 100 lists. Re-subscribing them all every time a
> subscribed address was spammed would be murder.
Well, ya got me beat by a few lists...
Plussed addressing? Explain please... too lasy to google it.. ;->
I certainly do not mean that one should do it immediately with the first
spam... yet if things get out of hand.. then by all means...
Scripting does an awesome job of dealing with this situation though...
And btw, im sure many of you have seen a new customer go from first coupla
emails in and out and a week later they are getting 500 to 1000 spams a day
haven't you?
You know what I mean?
- rh
--
Robert - Abba Communications
Computer & Internet Services
(509) 624-7159 - www.abbacomm.net
RE: Any suggestions for 'postmaster' spams?
Posted by Kenneth Porter <sh...@sewingwitch.com>.
--On Monday, October 16, 2006 7:53 AM -0700 R Lists06
<li...@abbacomm.net> wrote:
> Make another and use it for all lists. When you get spammed on it, change
> it slightly, unsub the other and sub the new to all the lists you are on.
Plussed addressing helps here. I hate web forms that refuse to let me put a
plus sign in my email address. (Typically a result of over-zealous input
filtering.)
I probably subscribe to 100 lists. Re-subscribing them all every time a
subscribed address was spammed would be murder.
RE: Any suggestions for 'postmaster' spams?
Posted by Mark <ad...@asarian-host.net>.
> -----Original Message-----
> From: R Lists06 [mailto:lists06@abbacomm.net]
> Sent: maandag 16 oktober 2006 16:54
> To: users@spamassassin.apache.org
> Subject: RE: Any suggestions for 'postmaster' spams?
>
>
> Does anyone have suggestions on how to handle this? They're all
> semi-standard 'delivery failure' or 'content blocked' notices, so I
> created filtering rules based on the subjectline to put them all into
> a folder. I don't think they should be marked as spam though because
> they're not.
You could use SRS to sign outgoing envelope-from addresses (like I do).
And then run SRS checks on the return. Guaranteed to stop ALL fake DSN
messages. No false positives, ever. If you're running sendmail, have a
look at:
http://www.srs-socketmap.info/
Signing envelope-from addresses, however you wind up doing it, is really
the best protection.
- Mark
RE: Any suggestions for 'postmaster' spams?
Posted by R Lists06 <li...@abbacomm.net>.
>
> It appears that my email address is now being used as a from address in
> many spam emails to many addresses. Over the past week, I have gotten 150+
> "postmaster: mail delivery failure" -each day-.
>
> Does anyone have suggestions on how to handle this? They're all
> semi-standard 'delivery failure' or 'content blocked' notices, so I
> created filtering rules based on the subjectline to put them all into a
> folder. I don't think they should be marked as spam though because they're
> not.
>
> Thanks,
> Brian
>
First suggestion, don't post to list with the email address you use for biz
or personal use.
Make another and use it for all lists. When you get spammed on it, change it
slightly, unsub the other and sub the new to all the lists you are on.
Also, if your MTA will accept an email to an email address that doesn't
exist, fix it so it doesn't.
Pry more yet escapes me now
- rh
--
Robert - Abba Communications
Computer & Internet Services
(509) 624-7159 - www.abbacomm.net