The following was on the SPAM-L list, a group that deals with trying to stop
people from sending unwanted and unsolicited e-mail to a large number of lists.
As Helen Glazer said so well, responding to the list only compounds the
problem.

If you are using a terminal session on a Unix system the commands here will
work,  then express your displeasure with the owners of the systems that allow
people to continue to send out SPAMs. Most Internet Service Providers are very
responsive, but those who send SPAMs have learned how to stay one step ahead in
the game. As long as people make money sending out SPAMs, they will continue.

The following is a way to verify that the person who posted the SPAM is a
legitimate user on the originating system.

--john chadwick
[log in to unmask]

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

First, use nslookup to find an authoritative name server for the
domain in question. The syntax is "nslookup -q=ns domain.in.question"

$ nslookup -q=ns bvoice.com
Server:  merlin.datawave.net
Address:  0.0.0.0

Non-authoritative answer:
bvoice.com      nameserver = NS.HOOSIER.NET
bvoice.com      nameserver = NS.LSI.NET

Authoritative answers can be found from:
NS.HOOSIER.NET  internet address = 206.106.64.10
NS.LSI.NET      internet address = 206.106.127.10

========

OK, now ask an authoritative nameserver for the mx record
for he domain in question. This tells us where mail to that
site really goes. The syntax is
"nslookup -q=mx domain.in.question nameserver"

$ nslookup -q=mx bvoice.com ns.lsi.net
Server:  user.lsi.net
Address:  206.106.127.25

bvoice.com      preference = 5, mail exchanger = mail.lsi.net
bvoice.com      nameserver = ns.lsi.net
bvoice.com      nameserver = ns2.lsi.net
mail.lsi.net    internet address = 206.106.127.25
ns.lsi.net      internet address = 206.106.127.25
ns2.lsi.net     internet address = 206.106.127.10

========

From the above, it appears that mail to "[log in to unmask]" is actually
handled by mail.lsi.net. So telnet to port 25 at mail.lsi.net and
ask about the account you're wondering about.

$ telnet mail.lsi.net 25
220-user.lsi.net Sendmail 8.6.9/8.6.9 ready at Wed, 1 Jan 1997 02:55:53 -0500
220 ESMTP spoken here
vrfy mredman
250 <[log in to unmask]>
expn mredman
250 <[log in to unmask]>

=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=