On Tue, 2004-12-28 at 11:32 -0500, Christopher X. Candreva wrote: > It is not immediately obvious why, if you are NOT generating new bounce > e-mails (which no one should be doing), you should also be silently > discarding viruses instead of returning a 550/554 error code. > > It would seem to me that if you aren't generating bounces, you would WANT > to return a 550/554 in the SMTP transaction, so any valid senders would know > that their mail was not accepted.
That's still back-scatter, just one relay removed. If Lucy is infected, and sends mail with Mary's return address through Lucy's usual mail relay, then when the relay gets a 554 it will send the DSN back to Mary, often including the virus. Mary then gets infected and starts sending mail with Joe's return address.... Best to just smile and say "thanks" while you drop it all in the memory hole. -- Daniel J McDonald, CCIE # 2495, CNX Austin Energy [EMAIL PROTECTED] _______________________________________________ http://lists.clamav.net/cgi-bin/mailman/listinfo/clamav-users
