I looked at the received-from headers, and it looks to me like these messages are being fed into the list from the web interface. The first received from is from mailman web and a private IP. On 8/6/20 2:09 PM, David Galloway wrote:
Hi all,
As previously mentioned, blocking the gmail domain isn't a feasible solution since the vast majority of @gmail.com subscribers (about 500 in total) are likely legitimate Ceph users.
A mailing list member recommended some additional SPF checking a couple weeks ago which I just implemented today. I think what's actually happening is a bot will subscribe using a gmail address and then "clicks" the confirmation link. They then spam from a different domain pretending to be coming from gmail.com but it's not. The new config I put in place should block that.
Hopefully this should cut down on the spam. I took over the Ceph mailing lists last year and it's been a never-ending cat and mouse game of spam filters/services, configuration changes, etc. I'm still learning how to be a mail admin so your patience and understanding is appreciated.
-- Tony Lill, OCT, ajlill@AJLC.Waterloo.ON.CA President, A. J. Lill Consultants (519) 650 0660 539 Grand Valley Dr., Cambridge, Ont. N3H 2S2 (519) 241 2461 -------------- http://www.ajlc.waterloo.on.ca/ ---------------