Todd Vierling writes:
> Phony "From:" filtering is also a way to completely block an average site
> from using a news<->mail gateway, as most people post to USENET with fake
> e-mail addresses specifically to stop spam because of their posts.  

I was talking about both envelope from and header from.  Envelope
"from" filtering is often useless for something thats been through a
mailing list gateway.  The gateway should have changed the envelope
from to point to some admin/bounce address.

> If you're filtering mail based on the "From:" field and using any of
> my mailing lists/gateways (and I have hundreds of them), chances are
> you won't be using them for long.

I would think not.  I certainly don't some misguided individual
sending me email with a phony return addresses either envelope or
header.  If your mail gateway is misconfigured to propagate such
nonsense, I wouldn't want any part of it.

> Now, phony _envelope_ filtering is something else, and something I
> use on my own site (it's specified as a recommendation in a RFC).  I
> also use the Realtime Blackhole List (http://maps.vix.com/rbl/) on
> all mail servers I host.  But I refuse to put "From:" filtering on
> them because of reasons stated above.

I use all the above, plus a history list based on IP of all spam that
got though in the past.

-wolfgang
-- 
Wolfgang Rupprecht    <wolfgang@wsrcc.com>     http://www.wsrcc.com/wolfgang/
	  Never trust a program you don't have sources for.