Guarding Against Forged Email Bounces

kemplej · 08-05-2005, 04:32 PM

I currently run a qmail+spamassassin+clamAV+vpopmail on a Slackware 10.1 server. One of the domains we currently host is being hit with bounced emails from spammers that forged our domain in their email headers. Is there any way I can guard against this or lessen the damange or anything at all? Or am I forced to just ride it out?
Thanks!

Justyn

Matir · 08-05-2005, 05:25 PM

Well, if they're coming into unused mailboxes, you could just redirect those to /dev/null with the .qmail files.

demian · 08-05-2005, 05:53 PM

I've had that happening with a site I once worked for. A few users were getting insane amounts (several thousand a day) of bounce messages. Management decided that moving the affected users to new addresses wasn't an option so we had to come up with a solution. Basically my idea was that bounce mail can only come from sites we actually send mail to. So what I ended up with was a script that parsed the log files and recorded every address the affected accounts sent mail to into a database and kept it there for a few days. On incoming bounce mail (checked with some typical regexp for bounce messages) the mta would do a database lookup and silently disregard the mail if the loopkup didn't return anything.

Matir · 08-05-2005, 08:16 PM

demian - quite an ingenious solution. Of course, it breaks down if users check email at home where it might go out through SMTP on their ISP, but every situation is different.

demian · 08-05-2005, 08:51 PM

Quote:

Originally posted by Matir
Of course, it breaks down if users check email at home where it might go out through SMTP on their ISP

Yeah, I could exclude that possibility. Every piece of mail went through our servers. I'd say that's the case in most all situations: Say you have an account joe@somesite.com and then go and send out your mail through yourisp.net. Wouldn't
a) the mailserver at yourisp.net reject the mail as unauthorized relay and
b) the receiving mailserver reject it since it claims to be from somesite.com but was in fact sent through yourisp.net???

I'd most probably reject such mail or at least increase it's spam score by quite a bit for such suspicious routing.

Matir · 08-05-2005, 09:16 PM

I hope not.

I send outgoing SMTP through my isp's mailserver, and most webhosts reccomend that. My ISP's mailserver just requires I be on their netblock or authenticate via SMTP-AUTH.