Re: [exim] Problems mitigating joe job

Top Page
Delete this message
Reply to this message
Author: Mike Cardwell
Date:  
To: Exim Mailing List
Subject: Re: [exim] Problems mitigating joe job
Matthew Newton wrote:

>> One of my email domains has recently been the (repeat) victim of a fairly
>> large-scale joe job. I am seeing thousands of back-scatter bounces for
>> addresses like fox1@???, fox2@???, etc. However, when this
>
>> What is the best way to handle this? General or specific answers gratefully
>> accepted!
>
> I've configured BATV here. If any users get this problem then I
> can enable it for them specifically. Any bounces for mails they
> sent in the last few days will be lost, of course, but from then
> on they are protected - bounces for non-locally generated e-mails
> will be rejected at SMTP time.
>
> I'd turn it on globally if it weren't for some nasty mailing list
> software out there that uses the return path as the subscribe
> address. :-(
>
> It is fairly easy to add support in Exim - see, for example,
> http://www.mail-archive.com/exim-users@exim.org/msg09242.html


I had a user that used to get Joe Jobbed constantly, mainly because he
has a catchall (I know). I configured BATV for him and he stopped
getting the bounces. Then I told him to configure SPF on his domains and
after a month or two the Joe Jobbers stopped using his domains
altogether. I could probably turn off BATV for him now because of that,
but it's doing no harm.

On my own email, I use BATV, SPF and DKIM and I don't use the testing
modes. I don't get Joe Jobbed.

Mike