Chris Edwards (chris@???) said, in message
<Pine.SOL.4.56.0402061651030.23624@???>:
>
> | The question is, how many mail systems bounce mail without including
> | the headers? If the answer is low enough, we would end up not passing
> | on any bounces that weren't in response to mail originating from our
> | systems.
>
> I've got a huge mailbox of (mostly mydoom-related) bounces sent to the
> "mydoom-special" localparts:
> Unfortunately I'd say a large proportion (possibly majority) have no orig.
> header info whatsoever :-(
That's a pain! It begins to look like freezing unrecognised bounces is the
only safe option (I might have a go at that and see how bad it gets). Of
course, if most of your bounces were from MyDoom, you'd have been OK to drop
them anyway. I suppose that's another question... Would the bounces you
received have contained the headers if it was the MTA that generated them
rather than some dumb antivirus plugin? If so, the scheme still holds
water!
I think I'm going to have a bash add adding the magic tag to mails. A few
weeks of logging the results returned would probably give an answer.
Cheers,
Alun.
--
Alun Jones auj@???
Systems Support, (01970) 62 2494
Information Services,
University of Wales, Aberystwyth
