[tamarian]

Update on the MD5 idea to check for forged bounced emails:

So far it seems most bounced emails will return the full original headers. The only exception I've seen so far is AOL, and only in the case when the AOL member in question rejects emails from your forum (i.e they are blocking your email from getting into their mail box.

So currently my upcoming version does the following:

1. Adds a new setting to enter your MD5 encryption string. If you leave it empty, it will not send the new header, and will process bounced emails as authentic. So it acts like an enable/disable option.

2. If you enter an MD5 encryption string, it will send the header out with outgoing email, but it will only check for them depending on the rules you set in vbouncer.inc pattern config file. This is done to allow the check to be turned on and off based on each pattern defined. If you define a pattern for AOL-sender-block (already defined in vbouncer.inc), you can set the check to no, so it will not ignore tham due to lack of the header.

3. If an MD5 header is defined, and the pattern requires the MD5 header, then it will ignore/skip bounced emails that do not have the header, or have the header but it did not match the MD5 key.

4. No additional manual queue to seperate which is which, since it's quite controllable by the settings, and only a small percentage (less than 1%) of bounced emails (in my logs at least) fall under this case.

So this is tested and running right now and ready for release as 1.0, let me know what you think.