Backscatter agent - false positive - ORF Forums

Backscatter agent - false positive RSS Back to forum

1

Testing out the backscatter agent, I've configured it to forward emails to myself rather than rejecting outright. It seems that we've got some false positives happening - as best as I can tell, the recieved bounce does have the correct Message-ID and otherwise looks like a legit bounce. (Other legit bounces are being let through).

Is there anywhere I can send this for futher review?

by Shannon McCracken more than 10 years ago
2

Never mind - after looking at them, I realised following the example, I was using a regex of using ".*@internal.local$", but the internal server name was actually in the outgoing emails meaning the real pattern I should be using is ".*@server.internal.local". I just cheated and set it to ".*internal.local$" (removing the @ sign) - which I believe will be reliable enough (real backscatter seems completely alien and this avoids issues if we have a different internal mail server).

by Shannon McCracken more than 10 years ago
3

@Shannon McCracken: I'd recommend using

.*@.*\.internal\.local$

(please note that the dot characters should be "escaped" using backslash, otherwise the dot is interpreted as "any character", so it will match "minternalslocal" as well).

by Krisztian Fekete more than 10 years ago
(in reply to this post)

New comment

Fill in the form below to add a new comment. All fields are required. If you are a registered user on our site, please sign in first.

It will not be published.
hnp1 | hnp2