joe-jobbed, block 'undeliverable' messages?

[am.lists]

On 4/25/07, Chris Yuzik <itdept at fractalweb.com> wrote:
> Hi Guys and Gals,
>
> One of our domains has been joe-jobbed, big time. We're seeing multiple
> "undelilverable" messages per minute, and in some cases many from the
> same IP. This is the worst I've ever seen it. Short of sitting here
> adding each IP to a block list, is there any way I can filter these
> things out, tag them as spam, anything?
>
> Thanks,
> Chris
>

Typically, these joe-jobs are from non-existing email addresses (e.g.
asdfasdf at victimdomain.tld). When the non-delivery report is
returned, it's attempted to be sent to that address, which doesn't
exist. If you were using Postfix, you could use
reject_unverified_recipient in the smtpd_recipient_restrictions
section of main.cf.

This way, you'd flat out reject any message to asdfasdf at the MTA,
keeping your MailScanner from never even seeing it.

If you this might work for you (e.g. you are using Postfix) I can give
you more info about my particular setup (there's a little more to it
than that one line).

Angelo