Blocking from message envelope content?

[Alton Danks <ad...@calvin.edu>]

Hello,

According to the feedback I've gotten to some posts about blacklist/whitelist

problems, it appears that SA doesn't/can't look at the content of the message

envelope like the following:

>Mar 23 11:25:24 urim sendmail[6285]: i2NGPOmx006285:
>from=<22-8667029-calvin.edu?user <at> stderr.nikki-mail.com>, size=9856, 
class=0,
>nrcpts=1, msgid=<q6Lv10,932$6LvGFf7sqN7fFwOzPGvB <at> mx.nikki-mail.com>,


Is there another way to do the equivalent of a blacklist outside of SA?
Ideally 
before even sending the message to SA? We are using sendmail with spamd and
the 
spamc milter.

Will a future version of SA be able to do this? SA looks at the message header

and message content. From my n00b position it seems like looking at the
message 
envelope would be a logical thing to do and would make SA more powerful.

We are getting about 100 spam messages a day that the message envelope in the

maillog shows fits *@stderr.*.* (.com, .net, .biz and counting.)
Unfortunately, 
only about 4 a day have the *@stderr.*.* pattern in the message header From:.

I also see other high-volume spam senders where there is a similar mismatch 
between the message envelope and message header.

Al

Re: Blocking from message envelope content?

[Al Danks <ad...@calvin.edu>]

> using /etc/mail/access you can even 550 the message before the data is 
> delivered...
> 
> 

Matt,

Hopefully my linux literate student assistants will know what you are referring 
to.

Thanks, Al

Re: Blocking from message envelope content?

[Matt Kettler <mk...@evi-inc.com>]

At 02:05 PM 3/25/2004, Alton Danks wrote:
>Is there another way to do the equivalent of a blacklist outside of SA?
>Ideally
>before even sending the message to SA? We are using sendmail with spamd and
>the
>spamc milter.

using /etc/mail/access you can even 550 the message before the data is 
delivered...