On Sun, 2008-02-24 at 10:27 -0500, chas@??? wrote: > I'm curious about this same subject and the way that Exim deals with it.
> Is Exim accepting and then delivering back a message to whom it believes
> to be the original sender or denying the message before receiving it.
I think the OP wants Exim to not send any errors which originate
remotely to his users, although that's not entirely clear.
> There are people out there that spoof the 'sender' address in order to
> have their spam forwarded to unsuspecting recipients.
Yep, well known.
> Any info on the way Exim handles these items and, as the original poster
> asked, is there a way to disable this.
How is your copy configured? None of us have a crystal ball, so we can't
tell you how it's working.
A good config which would minimise "collateral" spam would do the
following:
1. Apply as many checks during the SMTP transaction as possible;
depending on policy, these would then combine to create an SMTP time
rejection (*not* a bounce). In this case, you'd verify the local
recipient is valid, verify the sending domain is valid (exists, has MX
records, the MX records aren't in RFC1918 space and so on) at minimum.
2. Perhaps use BATV (look it up) to make sure that any incoming bounce
messages really are the result of messages originated by your systems.
It's possible to make Exim do almost anything [1] so we'd need to see
your config to tell you how yours handles errors.
[1] Well, it won't make the tea, or come diving with me, or get my kids
to sleep... but you probably get the idea :)
