[Mimedefang] [OT] Advice for RFC1123 5.2.9

Michael C. Hanson mch at quicksilver.com
Wed Jun 25 09:18:01 EDT 2003


Looking for some advice on how to handle the following situation:

First, I realize that RFC1123 5.2.9 requires the acceptance of from "<>"
With that said, I'm looking for advice on how to handle the following:

Jun 24 16:44:52 shiba sendmail[29448]: h5ONiq7I029448:
<5mf7kurq0xv at quicksilver.com>... User unknown
Jun 24 16:44:53 shiba sendmail[29448]: h5ONiq7I029448: from=<>, size=0,
class=0, nrcpts=0, proto=SMTP, daemon=Daemon1,
relay=mta156.mail.scd.yahoo.com [66.218.86.72]
Jun 24 16:45:00 shiba sendmail[29456]: h5ONj07I029456:
<5mf7kurq0xv at quicksilver.com>... User unknown
Jun 24 16:45:00 shiba sendmail[29456]: h5ONj07I029456: from=<>, size=3737,
class=0, nrcpts=0, proto=ESMTP, daemon=Daemon1,
relay=205-158-62-23.outblaze.com [205.158.62.23]
Jun 24 16:45:14 shiba sendmail[29467]: h5ONjD7I029467:
<xrazk5mh0ul at quicksilver.com>... User unknown
Jun 24 16:45:14 shiba sendmail[29467]: h5ONjD7I029467: from=<>, size=4603,
class=0, nrcpts=0, proto=ESMTP, daemon=Daemon1, relay=vasara.almamedia.fi
[194.215.205.131]
Jun 24 16:45:16 shiba sendmail[29469]: h5ONjF7I029469:
<15twahz8 at quicksilver.com>... User unknown
Jun 24 16:45:16 shiba sendmail[29469]: h5ONjF7I029469: from=<>, size=1024,
class=0, nrcpts=0, proto=ESMTP, daemon=Daemon1,
relay=mailhub2.mail.cornell.edu [132.236.56.26]

I receive these types of connections on a semi to high basis. I assume this
is a form of dictionary 'attack' spammers use to find legitimate e-mail
addresses on a server.  I realize I can't reject mail solely on the basis of
"from=<>" but these attacks are really starting to be a problem. While I can
(and have) throttle the connections, I'd much rather find a more permanent
solution -- e.g. Writing a filter sub-routine that adds the relay addresses
to my access file, but I can't see far enough ahead in to the future to see
if that's a bad idea, or not.

Anyway,  I'd appreciate any comments, suggestions on the matter.

Thanks. 

-- 
Michael C. Hanson
Quicksilver Software, Inc.
mailto:mch at quicksilver.com




More information about the MIMEDefang mailing list