Backscatter occurs when someone you may have communicated with gets a virus, and then uses your email address to send out mass mailings... MANY of the servers they will contact do NOT follow proper protocol, and accept the spam, LATER returning it to YOU as an "Undeliverable" message.
The trouble has been that simply filtering all undeliverable messages would cause you to be unaware of delivery failures (unacceptable) but detecting legitimate messages has proved difficult.
A perfect solution would only allow bounce messages (undeliverable warnings) from people you have personally contacted, however that will be difficult to implement so as an alternative we have identified a way to detect a large number of these annoying servers, and simply block bounce messages from them - leaving normal bounces intact.
If the issue continues we will implement rules allowing people to block all NON-LOCAL bounce messages, which could further reduce the problem however does have some risk of deleting valid bounces so we will ignore this option for now.
After confirmation (and no disention) by you, our valued clients, we will set these new messages to auto delete.
FOR THIS FILTER TO WORK YOU MUST BE USING THE SPAM FILTER.
If you are, and a message is detected, you may see it reported like this contained in a message:
Content analysis details: (5.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 BBˍINˍBACKSCATTERERˍORG RBL: Received via a relay in
ips.backscatterer.org
[194.186.47.93 listed in ips.backscatterer.org]
** this identifies the message as coming from one of these misbehaving servers
0.1 RDNSˍNONE Delivered to trusted network by a host with no rDNS
0.1 BBˍFROMˍSERVERˍNAME detect bogus mail with server name in from
address
0.1 BOUNCEˍMESSAGE MTA bounce message
0.1 ANYˍBOUNCEˍMESSAGE Message is some kind of bounce message
5.1 BBˍBACKBOUNCE1 Received from relay in ips.backscatterer.org AND a bounce message
** this notes that the message is BOTH a bounce AND from a misbehaving server, which means we can almost certainly deleted it.
In the interest of the safety of your mail we are NOT making this rule auto delete mail at this time until live testing - which starts now.
Please pass along any feedback relating to these updates to the spam filter.
Also note if you do not have the spam filter enabled, if you are not automatically moving spam to your junk mail, or if you are receiving mail from other (non-bitblock) email accounts you may not benefit from these changes immediately.
Thank you!
Backscatter filter / spam rules added
Effective September 7th, 2008, we have implemented a SAFE backscatter filter.Backscatter occurs when someone you may have communicated with gets a virus, and then uses your email address to send out mass mailings... MANY of the servers they will contact do NOT follow proper protocol, and accept the spam, LATER returning it to YOU as an "Undeliverable" message.
The trouble has been that simply filtering all undeliverable messages would cause you to be unaware of delivery failures (unacceptable) but detecting legitimate messages has proved difficult.
A perfect solution would only allow bounce messages (undeliverable warnings) from people you have personally contacted, however that will be difficult to implement so as an alternative we have identified a way to detect a large number of these annoying servers, and simply block bounce messages from them - leaving normal bounces intact.
If the issue continues we will implement rules allowing people to block all NON-LOCAL bounce messages, which could further reduce the problem however does have some risk of deleting valid bounces so we will ignore this option for now.
After confirmation (and no disention) by you, our valued clients, we will set these new messages to auto delete.
FOR THIS FILTER TO WORK YOU MUST BE USING THE SPAM FILTER.
If you are, and a message is detected, you may see it reported like this contained in a message:
Content analysis details: (5.6 points, 5.0 required)
pts rule name description
---- ---------------------- --------------------------------------------------
0.1 BBˍINˍBACKSCATTERERˍORG RBL: Received via a relay in
ips.backscatterer.org
[194.186.47.93 listed in ips.backscatterer.org]
** this identifies the message as coming from one of these misbehaving servers
0.1 RDNSˍNONE Delivered to trusted network by a host with no rDNS
0.1 BBˍFROMˍSERVERˍNAME detect bogus mail with server name in from
address
0.1 BOUNCEˍMESSAGE MTA bounce message
0.1 ANYˍBOUNCEˍMESSAGE Message is some kind of bounce message
5.1 BBˍBACKBOUNCE1 Received from relay in ips.backscatterer.org AND a bounce message
** this notes that the message is BOTH a bounce AND from a misbehaving server, which means we can almost certainly deleted it.
In the interest of the safety of your mail we are NOT making this rule auto delete mail at this time until live testing - which starts now.
Please pass along any feedback relating to these updates to the spam filter.
Also note if you do not have the spam filter enabled, if you are not automatically moving spam to your junk mail, or if you are receiving mail from other (non-bitblock) email accounts you may not benefit from these changes immediately.
Thank you!
|
Like our support? We bet you'll like our service! |
|
|