Spoofed "mail from:" Allowing Access to Non-Public

[pete]

I don't know quite what can be done about this, so I'm asking the collective wisdom for
suggestions.

I have setup some mailing lists (PDLs) which I don't want anyone to be able to send to from
external. So these are protected with an ACL. Problem is, if someone from external sends
with a spoofed "mail from:", the ACI is overriden and mail gets delivered to the list. Problem
is that as these are supposed to be internal only lists, only SPAM gets sent from external.
Can anyone come up with a way to get around this? I guess that some sort of
authentication should (could?) be required in order to send to these PDLs?


Any ideas?

P

[cmcnabb]

I don't know if this helps, but I changed the internet addresses of my distribution lists. If I wanted an everyone pdl, instead of having the address of everyone@domain.com I would use something like "Peoplewhoworkhere@domain.com" (not my internet address, but it's similar) to fool the bots. Those bots would pick up on easy things fairly quickly.

[pete]

Interesting, but I'm using pretty obscure naming. (like 01 Global List 01)

Not sure how the addresses got out, either!

P