In message <200406221505.LAA12506(a)wordstock.com> Bryan Pope <bpope(a)wordstock.com> wrote: Seconded. Is there any way to block these things at the server? They all seem to be coming from the same machine: Received: from calidad.Rafalim ([200.0.214.34]) by huey.classiccmp.org (8.12.8p1/8.12.8) with SMTP id i5MFEfhd066233 for <cctalk(a)classiccmp.org>rg>; Tue, 22 Jun 2004 10:14:43 -0500 (CDT) (envelope-from cctalk-bounces(a)classiccmp.org) I'd put an IP based block on the machine, personally. That or set procmail to drop anything with "Received: calidad.Rafalim" in the headers. Maybe block messages to the list from "cctalk-bounces(a)classiccmp.org"? Usually SpamAssassin catches stuff like that with a DNSBL blocklist (the Spamhaus XBL tends to be quite effective), but that's useless if the classiccmp listserver is relaying them :) Later. -- Phil. | Acorn Risc PC600 Mk3, SA202, 64MB, 6GB, philpem(a)dsl.pipex.com | ViewFinder, 10BaseT Ethernet, 2-slice, http://www.philpem.dsl.pipex.com/ | 48xCD, ARCINv6c IDE, SCSI ... It's not the money I want, it's the stuff.

Yes, there is. The sender is in violation of RFC2821, for HELOing with a nonexistent domain ("rafalim" is not a valid top-level domain, so calidad.Rafalim cannot exist). However, few sites are willing to actually check that HELO domains resolve. I've never quite understood why. The usual reason cited is that it will stop legitimate mail; quite aside from the question of how legitimate the mail can be if it comes from a mailer that doesn't know how to speak SMTP, presumably this means that it's thought better to allow broken software to continue appearing fine so it can stay broken rather than expose the brokenness so it will get noticed (and presumably fixed). It's also coming from a host with no rDNS, which is more disputable, but still enough for a lot of places to block. /~\ The ASCII der Mouse \ / Ribbon Campaign X Against HTML mouse(a)rodents.montreal.qc.ca / \ Email! 7D C8 61 52 5D E7 2D 39 4E F1 31 3E E8 B3 27 4B