Re: Changing mailing list subscription process

[Thomas Goirand <thomas@goirand.fr>]

Robin H. Johnson wrote:
> Presently, we have been suffering some spam attacks against some of the
> Gentoo mailing lists, because of spammers using auto-responders.
> 
> Here's how they are conducting the attack:
> 
> 1. Spammer forges a mail from $LIST+subscibe@gentoo.org, sending it to
>    an auto-responder.
> 2. Lists sends a confirmation mail to the auto-responder.
> 3. Auto-responder sends mail, with intact confirmation data back to the
>    confirmation address (in Reply-To).

IMHO, your auto-responder is broken. Any good auto-responder should
detect a mailing list and should ignore every message from it. With
courier-maildrop, it's done like this:

if ( ! /^Precedence: (bulk|list|junk)/ && \
     ! /^List-Id:/ && \
     ! /^List-Unsubscribe:/ && \
     ! /^Return-Path:.*<#@\[\]>/ && \
     ! /^Return-Path:.*<>/ && \
     ! /^From:.*MAILER-DAEMON/ && \
     ! /^X-ClamAV-Notice-Flag: *YES/ && \
     ! /^Content-Type:.*message\/delivery-status/ && \
     ! /^Subject:.*Delivery Status Notification/ && \
     ! /^Subject:.*Undelivered Mail Returned to Sender/ && \
     ! /^Subject:.*Delivery failure/ && \
     ! /^Subject:.*Message delay/ && \
     ! /^Subject:.*Mail Delivery Subsystem/ && \
     ! /^Subject:.*Mail System Error.*Returned Mail/ && \
     ! /^X-Spam-Flag: YES/ )
{
   [... autoresponder code ...]

> I tried adding a specific Reply-To address in the header of the list
> text/ file, but it's made to part of the mail body instead of the
> header.

You should have tuned "customheaders", is it what you did? Because this
always worked for me, when dealing with the Reply-To: header...

Thomas