AdamMaas

DavidT, We currently have not closed the hole that Steven found, so this is likely the source of the bounces. The issue is being addressed but has proven somewhat more complicated than initially believed. The Autoreply issue is most likely not the problem here, although it was the source of the hits that the Deputies provided to me. Adam Maas Internet Security Specialist MCI Canada

Andrew, I do agree that it needs to be addressed. The first way is to ensure that only the actual vacation message is sent in the Autoreply (Sadly, less common than it should be, although MCI Canada does ensure this) which dissuades spammers from using that tactic to spam. The second is of course to prevent the spam from hitting the autoreplier in the first place, something that SpamCop seriously aids with, as do other solutions like Bayesian filtering. I am a fan of the service that SpamCop supplies. While I've been somewhat aggressive in my post upthread, that's simply a case of frustration over not being able to get the information I need to solve the issue. Thankfully StevenUnderwood's post indicated a problem that had slipped by my testing and MCI is working from that angle.

I dropped an extra quote in there by accident and missed it when editing. Fixed. Adam Maas Internet Security Specialist MCI Canada

As I noted, Out Of Office replies respond with the original Subject Line, which is not at odds with the data you've posted, but that doesn't make it spam. It came from my corporate email, with my .sig. I received some basic information, but not enough to determine whether or not an auto-responder was involved initially. Further investigation on MCI's side indicates that all three header snippets were almost assuredly from Vacation messages. They did not provide the requested Body information (which would NOT have compromised SpamCop's Spamtraps, but would indicate whether or not it was an Autoreply or actual spam). I tested this function myself to confirm that the body was not being included in the Autoreply. Read what I wrote again. The only way it could have happened is if said spam with a forged From: address hit a box set with an Out of Office autoreply. That is NOT a Bounce. And it is NOT UCE. Such Autoreplies are a required function of email for the Business World. If you are listing because of them, SpamCop needs to fix it's listing criteria. As this functionality cannot be used to spam anybody (Since the body isn't included in the Autoreply), and is required by MCI's clients for legitimate business reasons, MCI simply can't turn it off. 142.77.1.111 is not listed at http://psbl.surriel.com/. It's not listed anywhere except SpamCop at last check (Friday, 22 Sept). MCI is quite willing to fix our server if it is indeed broken. But SpamCop has not provided evidence that indicates that anything beyond an Autoreply is involved here. If SpamCop provides me with the necessary information which indicates an actual problem, I will get the system fixed. Adam Maas Internet Security Specialist MCI Canada adam.maas[at]ca.mci.com Steven. Thank you for this test. This has the information that I need, ca.mci.com is our local domain (and the domain the server lives in) and it appears that the server will relay (or bounce) for the local domains only. This could well be the issue that is causing the listings. This will be corrected. Once again, thank you, we had missed that possibility.