Joe Jobbed, etc.

[Kevin Miller]

One of my users is the victom of a joe job.  I'm getting hundreds of
messages like the following:

------------------------------------------------------------------
Your message did not reach some or all of the intended recipients.

      Subject:	Message Undeliverable!
      Sent:	12/5/2005 9:33 AM

The following recipient(s) could not be reached:

      jeanette_stgeorgehhvj at ci.juneau.ak.us on 12/5/2005 9:33 AM
            The e-mail account does not exist at the organization this
message was sent to.  Check the e-mail address, or contact the recipient
directly to find out the correct address.
            < mxg.ci.juneau.ak.us #5.1.1 SMTP; 550 5.1.1 User unknown>
--------------------------------------------------------------------

The address is valid, except for the last four characters before the '@'
sign.  Those seem to be random.  I using MS/sendmail on a gateway which
forwards to an Exchange 2003 box.  What I'd like to do is refuse these
at the MTA level.  I can't put that address in the access file though,
as the last four characters vary and access won't take a regex (to the
best of my knowledge).

If there's no way to do it at the MTA level, I guess a SA rule might do
the trick, setting them to a value above high scoring spam and just let
MS delete them.  If that's the best option, could someone please show me
the regex to test for in the rule?  I'm a bit weak in that arena.

Anybody have any other ideas on the best way to deal w/this?  I've got
SPF records (set to softfail at the moment) which may help some but not
enough yet.  

On a related note, I want to implement milter-ahead which would deal
w/this issue handily.  Has anybody set that up on a SuSE 9.3 or 10
server?  I have a few questions, but since that's a bit off topic to MS
I don't want to get too far off.

Thanks much...

...Kevin
-- 
Kevin Miller                Registered Linux User No: 307357
CBJ MIS Dept.               Network Systems Admin., Mail Admin.
155 South Seward Street     ph: (907) 586-0242
Juneau, Alaska 99801        fax: (907 586-4500
 

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!