Block null "from" in logs

[Stephen Swaney]

> -----Original Message-----
> From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
> Behalf Of Mike Kercher
> Sent: Friday, September 30, 2005 9:35 AM
> To: MAILSCANNER at JISCMAIL.AC.UK
> Subject: Re: Block null "from" in logs
> 
> I think if you do this, you break RFC's 821, 1123, 2505, and 2821.
> 
> Mike
> 

I knew it was at least RFC 1123 but when you're a small IPS getting a
million + bounced messages a day from a vicious and intentional Joe job and
your business is at stake, I can understand why one might consider this
approach. 

The actual approach we took was to quickly setup another gateway and point
all of the incoming email for the domain that was under attack at the new
gateway that used this modified sendmail file. The other hosted domains then
were then unaffected by the attack and the valid email to the domain under
attack was delivered pretty much on time.

But your point is very valid. DO NOT DO THIS unless this unless you have no
other choice.

Steve

Stephen Swaney
Fort Systems Ltd.
stephen.swaney at fsl.com
www.fsl.com

> > -----Original Message-----
> > From: MailScanner mailing list
> > [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf Of Mauricio Cavalcanti
> > Sent: Friday, September 30, 2005 8:04 AM
> > To: MAILSCANNER at JISCMAIL.AC.UK
> > Subject: Block null "from" in logs
> >
> > Hi,
> > Anyone can help me to make a rule to block e-mails that comes
> > with null from in header (from=<> in mail.log).
> >
> > Thanks in advance,
> > Mauricio
> >
> > ------------------------ MailScanner list
> > ------------------------ To unsubscribe, email
> > jiscmail at jiscmail.ac.uk with the words:
> > 'leave mailscanner' in the body of the email.
> > Before posting, read the Wiki (http://wiki.mailscanner.info/)
> > and the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> >
> > Support MailScanner development - buy the book off the website!
> >
> 
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
> 
> Support MailScanner development - buy the book off the website!

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!