Handling bounced spam messages

[s. keeling]

Incoming from Mark Constable:
> The admin users of mine and vhost domains get bounces back for
> all sorts of reasons and they often go into an unsure folder
> [snip]
> (Sure, I could try some variations but I thought someone else
> may have already tackled this and have a reliable strategy.)

Perhaps not what you were looking for, but I ran across this on the
weekend (for procmail).  I've been getting lots of bounces to viruses
forged in my name:

:0
* H ?? ^FROM_MAILER
{
   LOG="Virus Bounce - "
   :0D
   * B ?? ^Received: from .*spots\.ab\.ca \(.*\[[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\]\)
   * B ?? !^Received: from .*spots\.ab\.ca \(.*\[209\.115\.[0-9]+\.[0-9]+\]\)
   ${MAILDIR}/virus-mail
}

Change "spots\.ab\.ca" to your domain, and "209\.115" to match your
IP.

I tend to weed out obvious cruft first, leaving bogofilter to work on
the non-obvious stuff.
 

-- 
Any technology distinguishable from magic is insufficiently advanced.
(*)    http://www.spots.ab.ca/~keeling      Please don't Cc: me.
- -