Can the null address be specified in a ruleset?

[Jim Holland]

On Thu, 20 Apr 2006, Dhawal Doshy wrote:

> Alex Neuman wrote:
> > Do you know of a good way to silently discard these messages selectively?
> 
> Can be done if you are using simple 'mailscanner' blacklists (not SQL OR 
> ByDomain) with a rules like this.
> 
> Is Definitely Spam = %rules-dir%/is.definitely.spam.rules
> Definite Spam Is High Scoring = yes
> 
> %rules-dir%/is.definitely.spam.rules
> ====================================
> From: postmaster@* and To: joe-jobbed at domain.tld yes
> From: mailer-daemon@* and To: joe-jobbed at domain.tld yes

This is why I first started this thread.  The problem is that as
MailScanner looks at the envelope sender address, which is the null
address <>, the above rules simply don't work in this case.  I am 
therefore proposing that Julian provide the additional functionality of 
allowing rules such as:

From:	<> and To: joe-jobbed at domain.tld	yes

which would at least give them some temporary respite from the problem,
while unfortunately blocking any genuine bounces from other systems at the
same time.  A deliberate joe job mostly requires the person to change
their address, as it can go on for years in some cases.  (We had to drop
one of our subdomains when it was seriously joe-jobbed.)
 
> Another way to do it would be at the delivery level.. say procmail /
> maildrop etc.. Write a rule to dump such mails in to folder (so as to
> not lose any valid bounces) OR simply /dev/null them.

I think some kind of custom filter such as the above is the correct 
solution.  For the moment however I am just using my contacts with 
their upstream ISP to try to get it resolved.

Regards

Jim Holland
System Administrator
MANGO - Zimbabwe's non-profit e-mail service