Re: [exim] how to detect if address aliased?

On 12/15/05 12:01 PM, "Ian Eiloart" <iane@???> wrote:

> Actually, we completely separate message submission (MSA) from mail
> exchange (MX). We run a second instance of Exim, listening to a different
> IP address, with a separate configuration. Same server, though. Given that
> spammers always use the MX address, it means they never hit our MSA server.

Well, some spammers do. Some use what was the MX some time in the past
(sometimes the remarkably distant past).

One way to accomplish that would be with a file sent off to a 'bot farm
containing the message, recipients, and server IP for each recipient (and
forged sender, etc). The spammers may well have fancier ways to do it.

Here, lots of spammers still hit the MSA address (and get rebuffed*), which
used to be the MX address. (Next time, we won't repurpose the address that
way.)

* with a message we can easily count in the logs (only 1,231 RCPT commands
rejected yesterday for that, which is lower than I remember it being a year
ago).

--John