[SLL] [Fwd: Delivery Status Notification (Failure)] - joe jobs

[Dave Dennis]

On Sun, 15 Feb 2009, Paul Franz wrote:

> I'm getting deluged with thousands of these joe jobs due to some spammer using my
> e-mail address in his "reply to:" header. Most come from qmail and Exchange servers.
>
> What is the proper way to fix this problem? I could treat each of these joe jobs as
> spam and automate a reply to them using procmail. It started happening a few days ago
> just getting a few hundred of these joe jobs a day but now the problem is growing to a
> few thousand just today alone.
>
> Maybe I should make an effort to go after the spammer who caused the joe jobs in the
> first place.
>
> Comments?

Items to check:

1) Are you accepting for delivery on non existent local addresses, or have a
catchall.  Fix that, obsolete config.  See
http://spamlinks.net/prevent-secure-backscatter.htm

2) Don't auto reply, you'll contribute to the problem, might result in your
server being blocked in some places.  Just makes the problem worse.  SMTP's
broken enough, don't add to it.

3) Check your DNS hosting; are you secondary hosting anyone's DNS, or are you
secondaried anywhere?  A whole lot of trouble can be prevented by taking down
secondary DNS hosting for others, cause you are probably taking on their bounced
spams.

4) Similarly, are you "smarthosting" anyone.  Are the joe jobs the result of any
of your customers/users bouncing their spams to you

5) What MTA are you running?  If its postfix it will have some graylisting /
SpamAssassin that could help you out here a lot.

Those were in rough order of importance without seeing a header its all
guesswork.  If you want to forward me a header or server log I can attempt to
assist further.


Dave D

+-------------------------
+ Dave Dennis
+ Seattle, WA
+ Speakeasy, Inc.
+ dmd at speakeasy.net
+ http://www.speakeasy.net
+-------------------------