Spamtraphit by AAA.BBB.CCC.DDD 2010-04-01 12:29:07 +0000 [noreply]

Hello,

this is an autogenerated abuse complaint regarding your network.

abusix.org will return every single spamtrap hit as well as any other
abusive behavior to the responsible Network Operator or Abuse Desk.

PLEASE SEE ATTACHMENT FOR MORE SPECIFIC INFORMATION REGARDING THIS INCIDENT!
Report format is ARF (Abuse Reporting Format).

Further information can be found here:
http://www.ietf.org/rfc/rfc3462.txt
http://tools.ietf.org/id/draft-ietf-marf-base-00.txt

Need help parsing ARF?
http://rubyforge.org/projects/arfparser/
http://search.cpan.org/perldoc?Email::ARF

Information about this project can be found at http://www.abusix.org
Any questions left? Feel free to contact us directly by email: info [at] abusix.org

Thank you for your cooperation,

Your Abusix-Team



Feedback-Type: abuse
User-Agent: abusix-qp-0.01
Source-IP: AAA.BBB.CCC.DDD
Received-Date: Thu, 1 Apr 2010 12:29:07 GMT
Version: 0.1


Part 1.2
Subject:
Mail delivery failed: returning message to sender
From:
Mail Delivery System <Mailer-Daemon@server.domen.ru>
Date:
Thu, 01 Apr 2010 16:29:13 +0400
To:
xxxx.xx@xxxxxxxxxxxxx.xxx

This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

abuse@domen1.ru

hostmaster@domen1.ru

postmaster@domen1.ru

С этим может помочь только полное отключение обраток как класса.

писать бесполезно так как абузить все равно будут - они абузят по спам активности с ай-пи адресов и не слушают вас. есть еще вариант проводить проверку отправителя перед приемом письма но, это сломает получение писем от скажем icq которые делают это скриптом и с несуществующего ящика (в спанели это называлось call verification или как то так).

thank you for your request.

> > In a letter body it is specified that your system considers Bounce
> > messages (Mail delivery failed: returning message to sender) a spam.
We consider DSNs as Spam as long as they are not RFC compliance.

We are using 2 different ways to avoid handling DSNs as spam.
1.) We are publishing for all of our spamtrap domains so called SPF deny all
records. If you mailsystem would check for SPF, you would not send back an DSN
because you would not accept the message. SPF deny-all, and that is absolutely the
only part of SPF that makes sense, tells your mailsystem that a specific domain
should never be accepted, because this domain is not meant to send an emails.
2.) We are filtering for RFC compliant DSN messages. Regarding RFC 3464 "every"
DSN message MUST contain within the content-type a "report-type=delivery-status".
We are filtering for this. So if you send DSNs that are RFC3464 compliant you
should not receive reports for such messages.

I have tested this filters a few minutes ago and they are working properly.

> > According to RFC, in case of absence of the addressee on a server, it
> > should give about it the answer to the sender.
Partly right. You should first of all not accept messages from domains, that tell
you that they will never be used for sending mail. (SPF) And second you should use
DSNs for this and they should be RFC3464 compliant.

> > I ask you to reconsider a policy of your service regarding Bounce
> > messages.
We have a policy. And we use it. So there is no need for us to reconsider. We are
receiving around 20 million messages a day and filter about 100k Bounce Messages a
day. We have seen several mailsystems not creating DSN messages in the right way
and most of them started to change this and have never been seen again on our traps.

So please have a look at your DSN messages or send us one of the reports we sent
you, so we can have a look at it and investigate what's going on.


Thank you for your cooperation.

Решается одной строкой в exim

# accept mail to postmaster in any local domain, regardless of source
# accept local_parts = postmaster
# domains = +local_domains

# accept mail to abuse in any local domain, regardless of source
# accept local_parts = abuse
# domains = +local_domains

# accept mail to hostmaster in any local domain, regardless of source
# accept local_parts = hostmaster
# domains =+local_domains

Интересно, какой?