[rt-users] Mandatory Subject - EMail

[Kenneth Marshall]

On Wed, Sep 08, 2010 at 11:19:35AM -0400, Jason A. Smith wrote:
> On 09/08/2010 10:48 AM, Kenneth Marshall wrote:
>>
>> In principle, an informative bounce is okay. Unfortunately, it can
>> be taken advantage of by unscrupulous mailers to send SPAM messages
>> to other E-mail addresses with the consequent impact to your mail
>> reputation and ability to send E-mail from your domain to others.
>> If you restrict such bounces to local authenticated E-mail, then
>> you can minimize the risk through the use of accountability.
>>
>> Cheers,
>> Ken
>
> True, but if your RT is setup to accept email tickets from anywhere, 
> because there is no central directory of known email addresses and a need 
> for many people to be able to submit tickets, then it doesn't matter since 
> the "sender" (real or fake) will either get the no subject bounce or the rt 
> ticket created auto-reply.
>
> Also, in our procmail, the no subject check is the last filter before the 
> queue check rules.  Before these are several other rules to filter out 
> spam, and emails from mailers, lists, daemons, etc...
>
> ~Jason
>

True, these sorts of attacks are caught in our situation by the
anti-spam filter before submitting the message to RT. The same
setup could help ameleorate this back-scatter problem of a no-
subject bounce as well.

Cheers,
Ken