On 10 Dec 2004 at 12:46, John Horne wrote about
"Re: [exim] Discarding a message wit":
| On Thu, 2004-12-09 at 16:54 -0800, Fred Viles wrote:
| >
| > 2. Very little spam/malware these days is offered with the local
| > domain spoofed in the sender address.
| >
| Not sure why you say that, we receive a lot of spam trying to get
| through simply by using a local address. (Quick check of just one mail
| server shows nearly 1300 such messages rejected so far today.)
Hmm. Well, I said it because I have a quarantine rule in place that
places non-authenticated-external-source-local-sender messages in a
suspect folder for manual review. It catches *very* few messages
(less than 1 per week).
However, to get filtered this way messages first have to make it past
the DNSBL, spoofed HELO, sender verify, etc checks. And as I
mentioned mine is a low volume server (small business with a few
hundred legitimate and a few thousand bogus messages/day). That's
probably why our observations are different.
- Fred
