Rule for DNS MX Check

Max Kipness max at
Mon Nov 6 20:23:12 GMT 2006


I'm still having issues with receiving large image stock spam, which is
not being hit by Razor, Pyzor or DCC, SARES stock, or any of the others
except the SARES gif attach. It gets a low bayes score that brings the
score negative at times.

One thing I have noticed is that even though the sender IP does resolve,
it's usually to a dynamically generated host by a DSL company etc. Most
of the time the sender address does not match this IP.

So after doing some research I'm wondering if there is a way either
through Sendmail, MailScanner or SpamAssassin to either check the MX
record of the sender header or match the From and Sender headers. I'd
prefer this to be a SpamAssassin rule so that I could release from
quarantine if there turns out to be FPs. I have a customer that deals
with a lot of foreign customers that might not have DNS setup.

Here is an example of a spam header received today (with my server
names/ips replaced with What I mean is that the From
header shows from, but it was actually received from If you did an mx check on you
definitely would not get the IP address. But simply trying
to match the Received domain to the sender domain would show something
is wrong.

Is there any way of scoring this stuff?


Microsoft Mail Internet Headers Version 2.0
Received: from ([]) by with
Microsoft SMTPSVC(6.0.3790.1830);
	 Mon, 6 Nov 2006 08:02:29 -0600
Received: from DESKTOP ( [])
	by  with ESMTP idkA6E235h002990
	for <mkipness at>; Mon, 6 Nov 2006 08:02:14 -0600
Received: from (HELO
     by with esmtp (2ST5N97RVEZ G4NVD)
     id O7FKEF-XTPYT5-6N
     for mkipness at; Mon, 6 Nov 2006 14:02:22 +0000
From: "Joel Lambert" <deborahstoryhn at>
To: <mkipness at>
Subject: hi Joel
Date: Mon, 6 Nov 2006 14:02:22 +0000
Message-ID: <01c701ac$2e3fbc00$6c822ecf at deborahstoryhn>
MIME-Version: 1.0
Content-Type: multipart/related;
X-Mailer: Microsoft Office Outlook, Build 11.0.6353
X-MimeOLE: Produced By Microsoft MimeOLE V5.50.4963.1700
Thread-Index: Aca6Q0YSVIA1BXARN9IQGMR9L98LID==
X-MailScanner-MailScanner-Information: Please email support at
for more information.
X-MailScanner-MailScanner: Found to be clean
X-MailScanner-MailScanner-SpamCheck: not spam, SpamAssassin
(score=0.752, required 5.5,
X-MailScanner-MailScanner-From: deborahstoryhn at
Return-Path: deborahstoryhn at
X-OriginalArrivalTime: 06 Nov 2006 14:02:29.0968 (UTC)


More information about the MailScanner mailing list