Re: Yes - a filter of some sort is needed

> It's called blowback. The spammers use domains that resolve (i.e.: are
> valid) in their forged "from" fields to get past filters.

> But the messages usually have some common characteristic, like using the
> word "reject" or "undeliverable" in the subject, so
> you can apply a quick filter rule at your end to nuke them. Even if you
> have to stay logged in to get the filter to work if it's on your client
> side. A better filter would be on the ISP's side, so you never see 'em.

So what is the origin of "Daemon" that is so common among the rejects.

I use MS Outlook for email, but pre-screen on BellSouth's server before downloading. I can check my email on Bellsouth's Webmail site from anywhere I find a connection, so it's become my primary access to email, until time to download.

Bellsouth already has a good filter service, Mailguard. But, for some reason, it was missing about 90% of these blowback messages. A number of them came as "Out-of-Office autoresponses.

> Are you on a webmail interface, or POP?

Both, but when I'm screening, it's webmail, 20 per page. The slow way is to scan, pick the isolated genuine email and move them to the Draft box for retrieval later. Then I can delete all the blowback.

> If you or the ISP can add a filter rule at their side, you can get offline
> for a while. Otherwise you need to set up a PC to stay on top of it,
> constantly on-line, and discard them when you get them with a local filter
> rule. Assuming you're on a POP account, not strictly web mail.

I'll have my first-born WebTech go the Spam Assassin route first, then contact BellSouth about raising the bar on MailGuard if possible to filter out all the "undeliverable, Daemon, reject*, etc. But, then I'll have to re-screen later to see if any rejects were legitimate "Undeliverables".

> What's the nature of the spam, anyway? The same pitch, or rotating
> subjects? Most of the real professionals already know they're criminals,
> but I might be able to find out the name of the perp, but it won't do you
> a lot of good if it's a Russian or Romanian.

Some of the "out-of-office" replies came from Germany, Denmark, and France - mostly in foreign languages. Of the few that I looked a little closer at, I saw maost were the "Investment advisories" (usually related to 'pump & dump' schemes.) I didn't open any of the spam itself, but noticed the stock/investment spam was common in the out-of-office replies and some of the Please remove me replies.

I did get a number of rejected post emails from Yahoo Groups and other bulletin boards.

Thanks for your advice.