Spam Filter ISP Support - * in email addresses

Print Page | Close Window

* in email addresses

Printed From: LogSat Software
Category: Spam Filter ISP
Forum Name: Spam Filter ISP Support
Forum Description: General support for Spam Filter ISP
URL: https://www.logsat.com/spamfilter/forums/forum_posts.asp?TID=5131
Printed Date: 26 December 2024 at 6:01am

Topic: * in email addresses

Posted By: Desperado
Subject: * in email addresses
Date Posted: 14 April 2005 at 4:30pm

Wish # 3271:

I would love an option to flat out drop any message whose email address contains a "*" .... or, even more better (love that English) doen't not meet RFC.

Regards,

-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Replies:

Posted By: LogSat
Date Posted: 14 April 2005 at 6:37pm

We check for the "%" character and block that since some older SMTP servers have bugs/security holes that cause them to be open relays if they see that. However for the "*" that should only cause a non-delivery, since most likely you don't have a user with the "*" in the email address.

...or are you referring to a sender with the "*" in the address?

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: Desperado
Date Posted: 14 April 2005 at 7:34pm

No .. The RCPT TO. I am seeing a huge increase in attempts to send to things like mailto:***dan@mydomain.com - ***dan@mydomain.com and yes, they get blocked but also quarantined.

Dan

-------------
The Desperado
Dan Seligmann.
Work: http://www.mags.net
Personal: http://www.desperado.com

Posted By: lead
Date Posted: 15 April 2005 at 5:46am

Sounds interesting.

How about modifiying the blacklists so to allow quarantine selection on each line.

eg keyword blacklist: (keyword, quarantine)

blockthis_dont_quarantine, false
blockthis_do_quatantine, true

Roberto, hope this didn't scare you?

Posted By: LogSat
Date Posted: 15 April 2005 at 7:08am

No scare at all. Let's wave the magic wand...

Done.

Take a look at the readme.html. below is the description for one entry. There are a few more (but not the keywords...) that allow the use of a NULL option to bypass the quarantine.

Blacklisted Domains - You can keep a file with additional Domains that you want to blacklist (based on the MAIL FROM field) by entering them below below. Enter one domain per line, wildcards (* and ?, same rules as DOS wildcards) are allowed. You can also use file:///c:/My%20Documents/Delphi%20Projects/SpamFilter/readme.html#Bayesian%20Statistical%20Filtering - Regular Expressions (RegEx). If the file does not exist it will be created. The file is reloaded every minute. The contents of the file will be loaded in the memo box, allowing you to make changes to the file. This list supports the :NULL option to send emails in a black hole. If an entry is in the form domain1.com:NULL it will cause all emails from domain1.com to be accepted and then sent to NULL right away. Such emails will not cause NDRs, they will not be quarantined, they will not be seen by the users. If an entry is in the form domain1.com:NoNDR such emails will not cause NDRs as in the DoNotSendNDROnQuarantine parameter in the ini file.

-------------
Roberto Franceschetti

http://www.logsat.com" rel="nofollow - LogSat Software

http://www.logsat.com/sfi-spam-filter.asp" rel="nofollow - Spam Filter ISP

Posted By: lead
Date Posted: 15 April 2005 at 7:23am

Thanks for the polite RTFM

I must admit I haven't read it in a while.

Print Page | Close Window