Re: [exim] Spam with no Message-ID header?

Top Page
Delete this message
Reply to this message
Author: John W. Baxter
Date:  
To: exim-users
Subject: Re: [exim] Spam with no Message-ID header?
On 8/11/09 6:58 AM, "Ian Eiloart" <iane@???> wrote:

>
>
> --On 7 August 2009 14:55:13 -0700 "John W. Baxter" <jwblist3@???>
> wrote:
>
>>
>> [Catching up]
>> Unfortunately, having a Message-Id: header is still a SHOULD, even in RFC
>> 5322. So one really ought not to reject based (only) on their lack. It
>> would be very nice if I could. (And if running a server only for myself,
>> I likely would, with provision for an exception list.)
>>
>
> Yes, but understand the meaning of SHOULD.
>   "SHOULD This word, or the adjective "RECOMMENDED", mean that there
>    may exist valid reasons in particular circumstances to ignore a
>    particular item, but the full implications must be understood and
>    carefully weighed before choosing a different course."

>
> The implication of ignoring any RFC5321 recommendation is that your mail
> may not get delivered. I think you can safely assume that people who really
> want their mail delivered will include a message-id.
>
> Valid reasons for not generating a message-id will look like: "My MTA is
> going to do it before releasing the email to the Internet, and is better
> placed to generate a globally unique message id".


Well, consider
2009-08-13 16:24:27 1Mbjel-0006G4-Lv <= Fidelity.Alerts@???
H=lrtp86.fidelity.com (fidelity.com) [192.223.136.149]:57171
I=[172.21.2.5]:25 P=esmtp S=3789

192.223.136.149 belongs to Fidelity Investments (seemingly the real one per
the listing provided by ARIN). I think they (and their client) want the mail
delivered.

And
2009-08-13 16:14:46 1MbjVO-0005Mw-Ar <= owner-saluki-l@???
H=altair.ease.lsoft.se [212.247.25.55]:60861 I=[172.21.2.5]:25 P=esmtp
S=4723
RIPE says 212.247.25.55 belongs to L-Soft and mailing list providers want
their messages delivered.

And many others--those were two obvious white hats found quickly in a slew
of output much of it obviously spammer-sent, without scrolling my window.

Is my method faulty?

grep '<= ' exim_mainlog | grep -v id=

All that said, I would be *delighted* to be able to ban messages without
Message-Id: headers.

Thanks for the comments, Ian. I'm still trying to learn (and recover from
the Exim 1 to Exim 2 transition (which we had a consultant do for us). ;-)

--John