Hugo van der Kooij wrote:
Will the mailinglist admin be kind enough to remove the address that is
resulting in these bounces? I have asked it outside the list several times
but apparantly NO ONE is listening.
They've been doing that for many months, possibly years now.
Unfortunately nobody can tell what the offending address is, since
ipadnet.br doesn't include the offending account name in their bounces.
The fact that they send the bounce to you, and not the list's
Return-Path: header is a RFC violation, and a dangerous one at that.
It appears their server breaks because they ignore the envelope
recipient and instead try to deliver snort-sigs as a local user. That
fails, as will all list postings or Bcc's from anywhere in the world.
Since it fails, and their mail system ignores envelopes, they decide to
also ignore the Return-Path and send the bounce back to the From: header
address... Also, in generating this error, they decide to ignore the
requirement of using a null return path (used to prevent bounces from
bouncing) and instead use postmaster as a return path. That's 3 errors
in handling a very common kind of message. Brilliant!
Ignoring the Return-Path inhibits the list's ability to automatically
handle broken mail accounts, and their generic message is completely
useless to anyone trying to fix the problem. Using a non-null
return-path creates a hazard of potential mail loops.
As a matter of defending your network from a dangerously misconfigured
server I recommend blacklisting their MTA. Given that their server fails
to handle messages with a envelope recipient that differs from the To:
line, fails to properly generate error messages, and has failed to get
fixed for an extended period of time it's probably best that you treat
the entire network as a danger to itself and others.
If you don't want to hammer the whole domain, at the very least you can
block all their dangerous bounce messages with one access entry:
postmaster@ipadnet.com.br 550 mail systems with broken bounces
are not welcome here
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Snort-sigs mailing list
Snort-sigs@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/snort-sigs
