Re: [exim] A cry for help - are there any plusnet admins out…

On 3/24/2011 3:07 PM, Heiko Schlittermann wrote:
> Hello,
>
> Dave Restall - System Administrator,,,<dave@???> (Thu Mar 24 15:50:22 2011):
>> I use exim to receive and process my emails - have done for years.
>> I also use sender callouts - have done for years. Occasionally emails
>> get rejected because they are sent from non-existent addresses and sender
>> callouts don't like that.
> We're using callouts for sender verification, but we do not tell
> anybody. In similiar situations we try to explain why it's a bad idea
> to have an invalid sender, not mentioning callout verification at all. I
> try to explain, that, w/o a valid sender I never ever have a chance to
> tell anybody about a local delivery problem that's not already popping
> up at SMTP time. This way mail could get "lost" between the systems
> (not mentioning the "frozen" state here).
>
> But as mentioned in the other answers, it's a quite "religious" issue ☺
>

Yep - and they think that if they shout it long enough and hard enough
that somehow they will change reality. We welcome SAV calls to our
server so that at SMTP time other people can determine if a domain is
being spoofed. Otherwise spammers get to spoof out domains which would
result in email bounces coming back to us which takes up even more
resources.

Personally I have no place for religion in technology issues. It's all
about what works and what does not. For example, I used to say that SPF
was a totally useless technology. I have however found a few uses for it
when it comes to whitelisting. (SPF good && in my domain whitelist).

SAV is similar in that it is useful to determine if the sender is coming
from a bogus email address. I do respect the argument that it creates
some traffic. But SPF calls also create some traffic as well so if
you're on the Internet you'll be putting out data to people doing inquires.

There is also an upside to my SAV calls because once I determine an IP
needs to be blacklisted then I no longer make the SAV call and those who
use my blacklist stop making SAV calls as well causing a reduction in
traffic.

So - SAV is a lightweight call and I use it and it works.

For what it's worth - the best way not to have your domain spoofed is to
support SAV calls and not have a wildcard account. Spammers tend to
spoof domains where the validity of the sender can not be determined.