<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html;charset=ISO-8859-1" http-equiv="Content-Type">
</head>
<body bgcolor="#ffffff" text="#000000">
Brandon Hoppe wrote:
<blockquote cite="mid200603211556.k2LFueGZ000940@dlep30.itg.ti.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html; ">
<meta name="Generator" content="Microsoft Word 11 (filtered)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:#606420;
text-decoration:underline;}
pre
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
tt
{font-family:"Courier New";}
span.EmailStyle17
{font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
<div class="Section1">
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;">A virus on a users
machine from an outside domain keeps
sending email to a user on my domain. MailScanner is detecting the
virus and
removing it. But the problem is that I get these emails atleast once an
hour.
It always comes from the same place. It disguises itself as though the
email
comes from my domain, but the full headers shows it comes from another
domain.
For example:</span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<pre><tt><font face="Courier New" size="2"><span
style="font-size: 10pt;">Full headers are:</span></font></tt></pre>
<pre><tt><font face="Courier New" size="2"><span
style="font-size: 10pt;"> </span></font></tt></pre>
<pre><tt><font face="Courier New" size="2"><span
style="font-size: 10pt;"> Return-Path: <g></span></font></tt></pre>
<pre><tt><font face="Courier New" size="2"><span
style="font-size: 10pt;"> Received: from test-domain.com (cpe-24-170-49-168.stx.res.rr.com </span></font></tt></pre>
<pre><tt><font face="Courier New" size="2"><span
style="font-size: 10pt;">[24.170.49.168])</span></font></tt></pre>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;">My domain is named
test-domain.com. I am not on RoadRunner
so the rr.com address above is where its originating from. </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;">What’s the best way to go
about blocking this domain
or sub-domain so that I stop receiving the notices of detected virus
emails
from MailScanner. </span></font></p>
<p class="MsoNormal"><font face="Arial" size="2"><span
style="font-size: 10pt; font-family: Arial;"> </span></font></p>
</div>
</blockquote>
<br>
What MTA are you using. I'm using PostFix and have a check_helo_access
rule that rejects email falsely claiming to be from within my domain.<br>
</body>
<FONT COLOR = "Gray">
<br />--
<br />This message, including any attachments, is intended solely for the use of the named
<br />recipients(s) and may contain confidential and/or privileged information. Any
<br />unauthorized review, use, disclosure or distribution of this communication is expressly
<br />prohibited. If you are not the intended recipient, please contact the sender by reply
<br />e-mail and destroy any and all copies of the original message. Thank you for your
<br />cooperation.
<br />--
<br />This message has been scanned for viruses and
<br />dangerous content by
<b>Secure Resource</b>, and is
<br />believed to be clean.
<br />MailScanner thanks <a href="http://www.transtec.co.uk/">transtec Computers</a> for their support.
</html>