I noticed that I have received a few new spams lately that are making it through Spamfilter and the MAPs lookup.

They are doing this by taking my own IP address and putting it in the message header and sending email to Spamfilter as if it is coming from my domain.

The question is what would happen if I block my own IP address, would this work in stopping this practice ? Or would this kill my own email ?

Lee

When SpamFilter performs a MAPS lookup, it is checking the IP that is making the connection with your SMTP server, it is *not* checking the email headers. Even if spammers do place it in the headers, that is not interfering with the MAPS lookup. Placing your own IP in a blacklist won't help either, since the IP blacklist also only checks the physical IP making the connection.

Does it look like they are spoofing my IP then ?

The xxx.xx.x is my ip and mydomain.com is where they are putting my domain name.

================================================== Received: from ns [198.xxx.xx.x] by MYDOMAIN.com with ESMTP (SMTPD32-6.00) id A104B88D0266; Mon, 31 Mar 2003 14:03:32 -0500 Received: from 207.190.245.171 by 198.xxx.xx.x Mon, 31 Mar 2003 14:03:30 -0500 Received: from smtp0943.mail.yahoo.com ([195.146.212.215]) by omnify-exchange.OMNIFYSOFT.COM with Microsoft SMTPSVC(5.0.2195.2966); Mon, 31 Mar 2003 13:51:21 -0500 Date: Mon, 31 Mar 2003 13:58:12 -0500 From: "Paul" <7eat@aol.com> =================================================

Thanks for your help,

Lee

Lee,

I do not see the headers SpamFilter adds in this email. Has it been received by SpamFilter or did it go directly to your SMTP server?

Roberto

It's in there I just took it out to clean up the post so it would be easier to read.

It came directly into Spamfilter not my internal mail server.

Lee