Hello,
Have read the following:
http://forums.cpanel.net/showthread....=mail+spoofing
http://forums.cpanel.net/showthread....=mail+spoofing

and looks like I need some pointers and assistance to create email filter for one of my clients - Recently they started filling exim queue with backscattered email bounces (which my VPS server is trying to forward, further creating problems...)

Configuration: CPanel 11.18.3-R21703 (yes time for an upgrade...) on VPS

Targeted email: info@myclient.1234
which is forwarded to myclient@realdomain.5678

I do not belive client uses this for outgoing, but would need to verify.

Here is sample bounced email (domains and IPs masked)
******
1JxHHp-0003Zn-K3-D
This message was created automatically by mail delivery software.

A message that you sent could not be delivered to one or more of its
recipients. This is a permanent error. The following address(es) failed:

newsletter@victim.abcd
Unrouteable address


------ This is a copy of the message, including all the headers. ------
****** domains and IP addresses cleaned ****
Return-path: <info@myclient.1234>
Received: from [1.8.6.8] (helo=1.8.6.8)
by l8101.oxyd.net with esmtp (Exim 4.20)
id 1JxH9D-0007kZ-QF
for newsletter@victim.abcd; Sat, 17 May 2008 09:48:08 +0200
Message-ID: <000901c8b7f3$041fc51d$974f2fba@nbbrgby>
From: "Great watch Service" <info@myclient.1234>
To: "Amazing Watches" <newsletter@victim.abcd>
Subject: Hermes Watches

** spam text here **
******

So, looks like I need email filter for "bounced email", to filter on
Return-path: <info@myclient.1234>
or
From: "" <info@myclient.1234>

but do not know how to write exim filter or where to place.
Thanks in advance for assitance or link to exim filter guide.

Walter