Spam as failure delivery notice

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Pekka.Panulasofor.fi wrote:

> Not directly for Maia but we are getting lots of
failure delivery
> notices as spam, seems like spammer is using our mail
server-address and
> our sales e-mail and somehow servers are sending
failure delivery
> notices to our system even we have nothing todo with
them how is that
> possible? Any way to forbit these kind of messages?

This is quite common, actually--it's called a "joe
job".  The spammer
uses your email address during the "MAIL FROM"
portion of the SMTP
exchange, so your email address ends up in the
"Return-Path:" header of
the spam that the victims receive.  If the recipient address
doesn't
exist (which is quite often the case), the recipient's mail
server will
try to be helpful by sending a delivery failure notice to
the address in
the "Return-Path:" header--in other words, to
/you/.

Technically, then, these delivery notices are not
"spam" in the
conventional sense--they're sent by legitimate mail servers
that are
only doing their job.  Your own mail server would probably
do exactly
the same thing, under the circumstances (and probably does
this many
times a day).  This creates a bit of a dilemma, because you
don't really
want your Bayes database learning that delivery failure
notices look
like spam, and you don't want to report a legitimate mail
server's
legitimate output as spam--you wouldn't want other sites
reporting
/your/ delivery failure notices as spam, would you?  This is
one of the
few good reasons to choose the "Delete" option,
rather than classifying
the mail as "Spam" or "Non-Spam".  By
deleting it, it does not get
reported or used for Bayes training.

As for how to automatically identify such messages, the
problem isn't so
much technological as philosophical.  You could, for
instance, add a few
new SpamAssassin rules in your local.cf file to match
certain text
patterns that are common in these emails, but that would
just end up
getting them quarantined as spam, which is not ideal for the
reasons
I've explained above (to say nothing of the false positive
problem this
would cause, since such a rule cannot distinguish between a
legitimate
delivery failure notice and one generated by a joe-job).

In short, there's no easy solution to the joe-job problem
that doesn't
end up shooting you in the foot at some point.  Treating
these delivery
failure notices as spam will get them out of your inbox, but
it will
also teach your Bayes database that /all/ delivery failure
notices are
spam, and if you do spam reporting you'll be reporting
innocent mail
servers as spam sources.

- --
Robert LeBlanc <rjlrenaissoft.com>
Renaissoft, Inc.
Maia Mailguard <http://www.maiamail
guard.com/>

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGyVKjGmqOER2NHewRAk/uAJ9pKN4VjbCNx5g3oyzX9klAguTU0gCg
htpB
GZB0331ype91w6e6WRVEvag=
=jZWP
-----END PGP SIGNATURE-----
_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users

Pekka.Panulasofor.fi wrote:
>
> Hi
>
> Not directly for Maia but we are getting lots of
failure delivery 
> notices as spam, seems like spammer is using our mail
server-address 
> and our sales e-mail and somehow servers are sending
failure delivery 
> notices to our system even we have nothing todo with
them how is that 
> possible? Any way to forbit these kind of messages?
>
>

There are a good bit of things you can do to reduce this...
see:

http:/
/www.postfix.org/BACKSCATTER_README.html

Some of these are good, some are extreme.
_______________________________________________
Maia-users mailing list
Maia-usersrenaissoft.com
http://www.renaissoft.com/mailman/listinfo/maia-users