Fail Message is Fail Messages for Fail Messages that I NeverFailedto Send???

[Ed]

On Tue, Mar 10, 2009 at 4:16 PM,  <dorian.monroe at cox.net> wrote:
> And adding to Lisa's responses, you may need some header evidence to get your from/sending domain off the blacklists, if you've been added.  Otherwise, legitimate messages to/from you may get blocked.   :(
>
>
>
> Sent from my Verizon Wireless BlackBerry
>
> -----Original Message-----
> From: "Bryan O'Neal" <boneal at cornerstonehome.com>
>
> Date: Tue, 10 Mar 2009 15:43:04
> To: 'Main PLUG discussion list'<plug-discuss at lists.plug.phoenix.az.us>
> Subject: RE: Fail Message is Fail Messages for Fail Messages that I Never
>        Failedto Send???
>
>
> First, cheek your logs and see if your sending messages, or watch for SMTP
> traffic.  You can also see if your on a black list.  If you are really
> sending spam you should show up on a few within a couple of hours.
>
> However, the more likely case is that the infected machine is not yours and
> is using your address to forge the from header.  When the receiving server
> fails to deliver it politely informs who it thinks to be the sender.  Some
> servers are even kind enough to attach the original message so you can look
> at the headers.
>
> -----Original Message-----
> From: plug-discuss-bounces at lists.plug.phoenix.az.us
> [mailto:plug-discuss-bounces at lists.plug.phoenix.az.us] On Behalf Of Tuna
> Sent: Tuesday, March 10, 2009 3:36 PM
> To: Main PLUG discussion list
> Subject: Fail Message is Fail Messages for Fail Messages that I Never
> Failedto Send???
>
> This really clubs me in the kneecaps with a concealed-sword cane.
>
> Over the past two days, I have been getting these messages that would
> suggest that I'm sending viagra spam to people and failing at it. I am
> getting dozens of those qmail-send failmails. Some of them are in Spanish or
> German. I have been just marking them as spam so I wouldn't see them but
> THEY'RE JUST TOO MANY, CAPTAIN!!!
>
> I've actually been thinking of writing a little script server-side to just
> archive them and give them to me in a weekly digest, and during bad spells
> like this I could just have it not send them at all.
>
> If plug-discuss doesn't have a better solution, that is.
>
> kthx
> --

Tuna - toss the backscatter and check that you aren't listed as a
source for spam (abuse.net is good)

at first blush, it sounds like you are the victim of a joe job
(http://en.wikipedia.org/wiki/Joejob) and you should look into adding
an SPF entry to your DNS records (http://www.openspf.org/). That may
or may not help. If not, you may just have to abandon the email
address - joe jobs are one of the few ways I've discovered to actually
fill a gmail account.

If you are going the hard core email server route, you can block
entire countries/continents by IP block at your firewall (IANA.net).
Only if nobody there has any business contacting you and it still
might get you listed as a not RFC compliant email server.
Unfortunately the easy script that only allows email from hosts you
have made contact with is baffled by load balancing server farms and
will block a lot of real email.

give SPF a try - Ed