recipient filter worked, then didnt

[jfh]

Hi,
I just added a recipient filter (global filter, built in, sender) for one of my addresses (hereafter referred to as "abc@addr"). I set it to bounce any mail sent to that address.
I sent a test email to abc@addr and it bounced.
A few minutes later, I received an email to abc@addr! It was a failure notice from another domain, and it was not bouncing my bounce, it was a perhaps spoofed bounce of spam supposedly from abc@addr.

I looked at the full header, the To and first Delivered-To fields are both abc@addr.
The filter is still active. Any clue why this wasn't bounced?

[Bob]

Hello,

For something like this we really seed to see the full raw headers of the email you received that you think should have been filtered.

Best to send to Service@FutureQuest.net. You would need to access the full raw headers and copy and paste them in a message.

-Bob

[jfh]

OK,
Thanks for your reply, Bob. I haven't received any more mail to that address, so I'm assuming the one in question was somehow still in transit. I'll just delete it.
Thanks

[jfh]

One last point ... as I said in the first post, I set the filter to BOUNCE mail sent to certain email addresses. This is useful because I still have catchall activated and get a lot of spam to some specific addresses.

Elsewhere in the forums, FQ seems to say never use bounce; however, if I didn't have catchall activated then everything sent to addresses other than the ones I explicitly created will bounce, right?

I'd appreciate a response from the FQ team.

Thanks!
Jim

[jfh]

And one more topic for recipient filters: I was not able to create a recipient filter for one pesky address which has a leading pipe, ie "|abc@mydomain.com". Any suggestion on how to target mail sent to that address?

[Kevin]

There is a big difference between your bounce filter and a non-existent recipient bounce.

When someone sends an email message to an address that doesn't exist the server refuses to accept the message causing the server at the other end to either bounce the message to the original sender or simply drop it if it is a spam server.

When your filter bounces a message it is working with a message that has already been accepted. A new email message must be generated containing the bounce and it will be addressed to whoever is on the From: line which in the case of spam is almost certainly not who sent it. When that happens the recipient of the bounce assumes that YOU sent them spam disguised to look like a bounce.

[jfh]

So ... can I set up exceptions to the catchall instead? Ie, catch all except abc@addr, def@addr, etc.? This is what I wanted in the first place.

Also, if that is not possible and will not be added any time soon, am I "required", per FQ policy stated in other places, to change my bounce to something else (ie, black hole)?

Thanks

[sheila]

We do not currently offer the type of exceptions to the catch-all that you're looking for, and I'm not aware of any plans to implement that soon.

At this time you are not required to change your bounce action to some other action. However, you do have to set up a SpamAssassin filter on the address sending bounces that will delete suspected spam (or redirect it to a local POP mailbox for later review) so that you avoid sending bounces to spam emails. Sending bounces to spam emails is very bad and can get the FutureQuest mail servers blacklisted causing mail from our servers to be rejected. This can affect all of our clients. So you are required to take every step possible to prevent sending bounces in reply to spam emails.

If we receive complaints about your domain sending bounces to spams, we will review your email setup individually and contact you regarding the matter to see what steps you must take to prevent additional complaints.

[sheila]

And one more topic for recipient filters: I was not able to create a recipient filter for one pesky address which has a leading pipe, ie "|abc@mydomain.com". Any suggestion on how to target mail sent to that address?

This sounds like a possible CNC bug. Please write in to the Service Desk about this issue so we can look at it more closely and assign it to the proper team member for investigation.

[jfh]

Thanks,
I'd prefer to bounce email to unwanted addresses, but I've changed the filter to delete rather than bounce. I'll send a note to the service desk about the pipe address.

[kitchin]

If anybody's curious, when I researched it once, I came up with this:

RFC 3696 and errata, on the user-name part ("local-part"):

Without quotes, local-parts may consist of any combination of
alphabetic characters, digits, or any of the special characters

! # $ % & ' * + - / = ? ^ _ ` . { | } ~

period (".") may also appear, but may not be used to start or end the
local part, nor may two or more consecutive periods appear.

Quoting comes in two flavors, " and \, both of which I simply disallow even though they are legal.

Wow, pipe and backtick, who wants to deal with those!

[Melissa]

This sounds like a possible CNC bug. Please write in to the Service Desk about this issue so we can look at it more closely and assign it to the proper team member for investigation.Just a quick follow-up. jfh provided the support team with specifics regarding this issue. The pipe character has been added to the list of allowable characters and the filter should now accept addresses in the form "|abc@mydomain.com". Thanks again, jfh.