[Mimedefang] Soliciting opinions on filtering based on bad MX records

[Kenneth Porter]

--On Thursday, September 11, 2003 4:51 PM -0500 Michael Sims
<michaels at crye-leike.com> wrote:

> If I, as
> a legitimate mail relay, cannot access a domain's primary MX for any reason,
> I'm going to try the secondary, etc.  If the secondary points to loopback,
> I'm going to assume that the domain doesn't want to receive ANY mail for any
> reason, and I will further assume that any mail that claims to be from the
> domain in question must be a forgery.  Or worse yet, the domain in question
> is a direct spam source.  In either case, it's a worthy criteria to reject
> mail, IMHO.

Well, two approaches: reject if all MX are bad, vs. reject if any are bad. The
latter rejection would always happen under your scenario, while the first
would happen only if the primary (and all but the bogus MX servers) were down.
I would suggest adding an option to allow using the stronger criteria of all
servers bogus.

BTW, on the subject of bogus addresses, I recall someone maintains a bogon
list and it's available in several forms, including FTP and DNS. I probably
saw it on the DShield firewall list, or some other security-related list.