Using Sendmail to Bounce Spam Junk Mail

By Christopher K. (Chris) Koenigsberg

Good old Dejanews found this for me:

Subject: Re: Bouncing unwanted mail
From: ckk@uchicago.edu (Chris Koenigsberg)
Date: 1996/07/02
Sender: news@midway.uchicago.edu (News Administrator)
References: <4rb790$phj@mine.informatik.uni-Kiel.de>
Organization: U. of Chicago
Newsgroups: comp.mail.sendmail

There's a good example in either the Sendmail FAQ or else the sendmail-8.7.5/cf/README file, I forget which.

Following that example, I add this to the end of my .mc m4 macro master file:

LOCAL_CONFIG
FK/etc/sendmail.unconfigured-addresses
FL/etc/sendmail.locked-accounts
FN/etc/sendmail.misspelled-hostnames
LOCAL_RULE_0
R$*$=K$* $#error$@77$:Return address not configured in your email
application! Please fix this.
R$*$=L$* $#error$@77$:This account is locked and no mail to or from it
can be accepted.
R$*$=N$* $#error$@77$:You have mis-spelled the hostname in your return
address! Please fix this.

- ------------------------------

and then any incoming or outgoing mail with either the RCPT TO or MAIL FROM containing a string found in the sendmail.unconfigured-addresses file (e.g. "your_userid@your_host.com") will get bounced with the "Return address not configured" error, any mail with a string found in the sendmail.locked-accounts will get the "This account is locked" error.... and any mail with a string found in the sendmail.misspelled-hostnames (e.g. common typos like "@uchiacgo.edu") gets bounced with the "mis-spelled hostname" error.

So you could easily add a file "/etc/sendmail.rogue-domains" in a new "F" definition (find an unused variable, note that I skipped "M" because it's already used elsewhere, i.e. grep for "=M" in your sendmail.cf), and add an appropriate "mail is not accepted to or from this host" error.

Now, if they manage to forge things so the rogue domain doesn't appear either in a MAIL FROM or a RCPT TO envelope field, then this won't work.

Chris Koenigsberg
------- End of forwarded message -------