--On March 21, 2006 2:11:31 PM -0500 Valdis Kletnieks <[log in to unmask]> wrote: > On Tue, 21 Mar 2006 14:03:22 EST, Michael DeGregory said: > >> Is there anything specific we can look for when we sniff the port and >> get a probe failure? > > Look for a *second* piece of mail coming back the other way that looks > like a bounce message. > > Some sites are poorly set up, and will give a '250 OK' to essentially any > address, including a bad one - and then send a bounce message when they > discover the mailbox is in fact totally invalid. I've seen a few horrendously broken auto-reply/vacation systems send a message back, while also sending one along to the user too. > > A better configuration is to have the box able to issue a 450/550 "no > such user" error at the mail gateway - that way you get the benefit of: > > 1) You never have to accept and queue the mail for an invalid address. > 2) If the MAIL FROM: is bogus (as it is for much spam), it means you don't > end up trying to bounce the mail to a bogus address (or even worse, a > legitimate address that has been joe-jobbed). > -- "Genius might be described as a supreme capacity for getting its possessors into trouble of all kinds." -- Samuel Butler