Re: TCPIP$SMTP_POSTMASTER_ALIAS

Phillip Helbig---remove CLOTHES to reply wrote:
So this might solve the problem of double bounces. I was getting email
to non-existent users, then bouncing it from TCPIP$SMTP, which then
bounced back to me since the recipient (apparent sender of the spam) had
been forged. So if I bounce it from postmaster to a non-existent
recipient, the remote system should NOT bounce it back to me, right?

say you are chocolate.com

system X sends spam "from: username@xxxxxxxxxxxxx" to "baduser@xxxxxxxxxx"

Instead of immediatly refusing it witgh a 550 invalid username,
pastry.com accepts the message and later issues a non delivery
notification and sends it to the apperent originator: "username@xxxxxxxxxxxxx"


So your system gets a message from postmaster@xxxxxxxxxx indicating it
was unable to deliver a message from username@xxxxxxxxxxxxx to
baduser@xxxxxxxxxxx Message is addressed to username@xxxxxxxxxxxxx

Your system then attempts to deliver it to "username" locally to tell
him that the message he allegedly sent could not be delivered. This
fails, and the software then detects this is a postmaster message and
instead of bouncing it back to pastry.com, bounces it to the
"postmaster" account locally.

If username verification were done during the SMTP dialogue, then the
message from postmaster@xxxxxxxxxx to username@xxxxxxxxxxxxx would be
stopped there.

However, you, as system manager, wouldn't know that your domain name is
being used as a fake origin of spam messages.

--------

Second scenario:

You are the target of spam.

System X sends spame from baduser@xxxxxxxxxx to username@xxxxxxxxxxxxx

Your system receives it, accepts it. Then it realises that "username" is
not valid, so it generates a bounce to "baduser@xxxxxxxxxx". When
pastry.com accepts the TCPIP connection, it issues a 550 "user not
found" right away. So TCPIP Services then immediadly hard fails the
message and tries to send a bounce of the bounce back to username.
However this fails and the software then sends that second bounce back
to the postmaster alias (which should be forwarded to a VMSmail address).


In these cases, immediatly refusing messages to invalid users (with the
patch at 5.4 or 5.5) solves that problem.

This is not ideal, since this would also reject stuff where the sender
had just mistyped a real email address, i.e. not spam to a non-existent
address. Would a real person sending email see the "not deliverable"
message?

Yes, except that message would be issued by his local SMTP server, not
you.
.

Relevant Pages

  • Re: PLUG: PMAS
    ... The state of the art that can be obtained with DNSbsl is> 80% with out a DHCP list, and well into the 90% in spam detection. ... more good mail probably gets lost for other reasons beyond the mail server operator or network administrators control. ... So what DNSbls are you using that generate these higher rates of false positives? ... And most of the mail servers that I have seen allow local customization of the bounce message they send to their internal network users. ...
    (comp.os.vms)
  • Re: PLUG: PMAS
    ... appeared to be either an open proxy or completely owned by the spammer. ... out the spam history of a I.P. address. ... I have recently seen both Comcast and Google mail servers get rejected. ... I have seen Gmail file bounce messages from mail sent from it in the ...
    (comp.os.vms)
  • Re: Beware of ISP spam filtering
    ... They receive the mail and tell the sender that they've got it correctly. ... Then they open a new connection to the destination server to pass the ... OTOH, if the destination server says no, maybe because the spam or virus ... it can send a bounce to let the supposed sender ...
    (uk.telecom.broadband)
  • Re: Mail.app "Bounce" Option
    ... It sends a bounce message to the same mail server that sent you the SPAM message. ... and spammers are using it to send thousands of SPAM messages to people all day every day. ...
    (comp.sys.mac.apps)
  • Re: Anyone know about free product mailwasher
    ... MailWasher has one feature so bad I prefer not to recommend its use. ... If you do decided to go with MailWasher, do not use the "bounce" feature. ... your IP address, I can send a complaint to your provider, and copy the ... Designed from the ground up as a spam filter. ...
    (microsoft.public.security.virus)