[Mimedefang] code to handle "troublesome domains"

[Matt Cramer]

On Fri, 26 Sep 2003, Lucas Albers wrote:

> > http://lists.roaringpenguin.com/pipermail/mimedefang/2003-September/008088.html
> >
> > I posted some code that compared the sender's email address to the
> > sending relay for certain domains which spammers love to use (aol.com,
> > hotmail.com, etc.).  If user at hotmail.com came from a relay that did not
> > reverse resolve and match /.*hotmail.com/ I rejected it.
> Is it possible to just have this add to the spamassassin score?
> For example add +3 to mail that fails this check?
> That would seem to be a good method to reduce false positives but still
> check mail sent through using a false relay.

I am doing the "troublesome domain" check in filter_sender, and do not
call SpamAss until filter_end.  I suppose one could use a global variable
to save this info to add it to the score, or check during filter_end.  But
for my use I reject with a 554 as soon as the sender is found to be a
likely forgery on principle, and to save the overhead of actually
accepting the mail.


Matt

-- 
Matthew S. Cramer <mscramer at armstrong.com>          Office: 717-396-5032
Infrastructure Security Analyst                     Fax:    717-396-5590
Armstrong World Industries, Inc.                    Cell:   717-917-7099