Like many of the lower-end users we appear to be being pummelled by botnet owners testing their wares. Attacks are highly distributed, with Senderbase catching a fair chunk but CASE responding late (and I am checking that we are receiving our updates) if at all.
I have envelope sender DNS verification turned on for our mail flow policies covering our sender groups up to but not including our default group which starts at SBRS 0. Should I adjust our HAT to start the default group at a higher SBRS rating or enforce envelope sender verification for the default group? Aside from a HAT adjustment to a lower sender group, we're pretty much running as factory.
That brings me to my main question: how to block senders with no reverse DNS information? Am I correct in saying this is not an envelope sender verification failure as such?
I'd also like to do something about the more obvious dynamic hosts presenting themselves as host-999-999-999-999.fsckwittedispleftport25open.net or similar. I came up with the regex \D{0,X}\d{1,3}[-_]\d{1,3}[-_]\d{1,3}[-_]\d{1,3}\D{0,X} for use in a Remote IP / Hostname rule but am in two minds as to whether this is going to give me too many false positives. I'm going to have to guess a value for X, unless anyone has any suggestions.
