Spammers went from *.* to <> can we get a block for blank From senders please

Idea shared by network admin - 12/14/2017 at 2:28 PM

Proposed

Started seeing this the last few days.

[2017.12.14] 00:18:42 [52.40.33.93][61332321] rsp: 220 mail.americanlenders.com 52.40.33.93 Thu, 14 Dec 2017 00:18:42 -06:00
[2017.12.14] 00:18:42 [52.40.33.93][61332321] connected at 12/14/2017 12:18:42 AM
[2017.12.14] 00:18:42 [52.40.33.93][61332321] cmd: helo mailgun.net
[2017.12.14] 00:18:42 [52.40.33.93][61332321] rsp: 250 mail.americanlenders.com Hello [52.40.33.93]
[2017.12.14] 00:18:42 [52.40.33.93][61332321] cmd: MAIL FROM: <>
[2017.12.14] 00:18:42 [52.40.33.93][61332321] rsp: 250 OK <> Sender ok
[2017.12.14] 00:18:42 [52.40.33.93][61332321] cmd: RCPT TO: <decaturga@americanlenders.com>
[2017.12.14] 00:18:42 [52.40.33.93][61332321] rsp: 550 <decaturga@americanlenders.com> No such user here
[2017.12.14] 00:18:42 [52.40.33.93][61332321] cmd: quit

12 Replies

Reply to Thread

echoDreamz Replied

12/14/2017 at 2:33 PM

We have this in SM 16 now. It is the null sender check.

echoDreamz Replied

12/14/2017 at 2:34 PM

However, you have to be careful with it as bouncebacks and delivery failures can also be null senders.

network admin Replied

12/14/2017 at 2:42 PM

You mean this??? INCOMING OUTGOING
SMTP SMTP
Null Sender 30 N/A N/A

Yeah - DOES NOTHING!

echoDreamz Replied

12/14/2017 at 2:54 PM

Interesting. We do not use it as it has caused a lot of issues with delivery failure notices. May want to open a ticket to see what is happening. I know SM has had a lot of SMTP related issues lately, hoping they are fixed up with a release this weekend.

kevind Replied

12/14/2017 at 4:26 PM

You can see some history here:
https://portal.smartertools.com/community/a89479/null-sender-fix.aspx

Still a little work to be done. Hope to get null sender to 'block' as it only scores today.

echoDreamz Replied

12/14/2017 at 4:32 PM

You can "block" if you score the null sender high-end to trigger an SMTP block. Though we get a lot of legit emails that are null senders.

kevind Replied

12/15/2017 at 1:48 PM

Sounds interesting, but I would need a little explanation of how to set up null sender to trigger SMTP block. Guessing it would block all null senders, which is not what we want as there are a lot of legit messages.

Hoping to just have a checkbox so it can assign 10-15 points and when it combines with another RBL, SPF, etc. it will get blocked. That will allow the legit bounces in and reject the spam.

echoDreamz Replied

12/15/2017 at 3:06 PM

Nevermind, I see the check only applies to the spool level, not the SMTP layer.

kevind Replied

12/15/2017 at 3:16 PM

yyyesss...that's what I'm asking for!!! Please thumbs up my request here:
https://portal.smartertools.com/community/a89479/null-sender-fix.aspx

hey, have a nice weekend (don't spend it managing mail servers :)