Can the null address be specified in a ruleset?

[Jim Holland]

On Tue, 18 Apr 2006, Alex Neuman van der Hans wrote:

> I'm sure I could think of a couple of drastic solutions (firewalling 
> them, bouncing everything to the ISP CEO's home address, etc.) that 
> wouldn't really solve your problem.
> 
> Are you sure the spacing is right in your spam.blacklist.rules? I always 
> use tabs just in case, although I've heard you can use any whitespace. 
> Are you restarting MailScanner when you make the changes? Is the 
> "default" line at the end?

Yes/yes/yes.  I use spam.blacklist.rules all the time, so I am sure that I
am entering the details correctly.  However I would assume that
MailScanner does in fact ignore any angle brackets around an address.
 
> <vent>I really hate it when clueless admins do this. They should quit 
> their job, donate their severance check to charity, and choose another 
> profession :)</vent>
 
In this case the problem is with the infected corporate client of the ISP.  
They are ironically using MailScanner, but obviously haven't configured it 
correctly.  By receiving the bounces I can see exactly which of their 
computers is infected.  But so far I have not been able to get any 
response from the corporate client.  Now I just need to persuade their ISP 
to close them down for a little while (weeks? months?) until they get 
their act together.

> Jim Holland wrote:
> > Hi Julian
> >
> > I have a user who is receiving numerous erroneous bounces of "cleaned"  
> > viruses from a large local ISP.  The viruses are spoofing her address.  
> > The envelope sender address according to the log file is the null address
> > <>, although when received by the user it has the envelope address
> > MAILER-DAEMON at mango.zw that is added by our own system (mango.zw) after
> > receipt.  I have tried the following in spam.blacklist.rules:
> >
> > 	From:   <> and To: user at mango.zw          yes
> > and
> > 	From:   MAILER-DAEMON at mango.zw and To: user at mango.zw          yes
> >
> > but, not surprisingly, neither of these work.  Can you suggest any way to 
> > make such a rule work?  Or would it need to be a new feature?  I do think 
> > it would be very useful to be able to use <> if it cannot be done at the 
> > moment.
> >
> > I am not using SpamAssassin (don't have enough horsepower) so cannot use 
> > that.  And I don't want to block other mail from the major local ISP that 
> > is sending this junk.
> >
> > For the moment I will just try getting them on the phone once more . . .
> >
> > Regards
> >
> > Jim Holland
> > System Administrator
> > MANGO - Zimbabwe's non-profit e-mail service
> >
> >   
> 
> 

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service