How to block delivery of MAILER-DAEMON (<>) messages?

[Rose, Bobby]

We use milter-sender to do call-backs and it even checks for <>
violations and will reject if the system is in violation.  Also, there
are many people that used the RFC Ignorant DNSBL (including
Spamassassin) so if you do reject <> then you will most likely end up on
that list.

Relevant RFC references concerning the requirement for the Null Address
(<>) used for Delivery Status Notification:

RFC 2821 Simple Mail Transfer Protocol 
section 4.1.1.2 MAIL, BNF grammar 
section 6.1 Reliable Delivery and Replies by Email, paragraph 2 

RFC 2505 Anti-Spam Recommendations for SMTP MTAs 
section 2. Recommendations 6a. 
section 2.6.1. "MAIL From: <>" 

RFC 1123 Requirements for Internet Hosts -- Application and Support 
section 5.2.9 Command Syntax: RFC-821 Section 4.1.2 

RFC 821 Simple Mail Transfer Protocol 
(obsoleted by RFC 2821) 
section 3.6 
section 4.1.1 
 

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Matt Kettler
Sent: Friday, December 10, 2004 12:37 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: How to block delivery of MAILER-DAEMON (<>) messages?

At 10:47 AM 12/10/2004, Andreas Piper wrote:
>  am tried to define a ruleset for 'Deliver Cleaned Messages' to 
>exclude these messages from delivery, but I did not succeed, because 
>the envelope-from in these messages is <>, and the rule
>From:   /^$/    no
>seems not to be working.
>
>How can I solve this problem?

First, read the RFCs and understand that by inhibiting the null return
path you are violating RFC 822. It's a requirement to accept bounces in
the general case. Inhibiting them will also prevent any real bounce
messages from reaching your network. If you fully understand the
implications of what you are doing, and intend to only block these
messages for a short period of time to alleviate the problem, go on.  If
you have read the RFCs and still intend to block permanently, please
find a replacement admin and resign your position.

Second, the "deliver cleaned messages" option only applies to virus
infected emails that have been cleaned. It won't affect non-virus
messages.

Your best bet is to use the "Is Definitely Spam" ruleset, coupled with
"Definite Spam Is High Scoring = yes", and "High Scoring Spam
Actions=store" to quarantine them, or forward them to a common "bounces"
user account so you can review them. I'd strongly recommend not using
delete here, but it is possible.

------------------------ MailScanner list ------------------------ To
unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and the
archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!