Blocking emails that claim to come from our domain

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Nigel kendrick
> Sent: Sunday, December 04, 2005 4:05 PM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Blocking emails that claim to come from our domain
> 
> Apologies if the answer to this is staring me in the face - I have done a
> few searches but without any luck.
> 
> We are seeing a steady stream of emails from
> adsl-70-248-164-89.dsl.hstntx.swbell.net[70.248.164.89] that claim to come
> from an address in our domain (i.e.: admin at ourdomainname.com) and contain
> the usual stuff about verifying passwords, mail accounts being suspended
> etc. All legitimate users have to login to send mail so what's the most
> effective and simple way to block mail from external sources that contain
> our domain name? At the moment I am just putting the subjects in a
> spamassassin rule but it's a bit of a 'blunt' way of trapping them.
> 
> Thanks
> 
> Nigel Kendrick

If you're using sendmail take a look at:

http://www.cs.niu.edu/~rickert/cf/hack/block_bad_helo.m4 

Steve

Stephen Swaney
Fort Systems Ltd.
stephen.swaney at fsl.com
www.fsl.com

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!