Re: [Sqlgrey-users] Backup MX servers

[Ray B. <rj_...@rj...>]

Michel Bouissou wrote:

>Le Jeudi 16 Juin 2005 09:31, Ray Booysen a =E9crit :
> =20
>
>>I have started to notice more and more spam emails that are being sent
>>by MTAs that use the next available MX after I greylist the initial
>>connect.
>>   =20
>>
>
>I see the same.
>
> =20
>
>>My server then in turn greylists the connect from the backup=20
>>MX but it doesn't stop the spam or virus being delivered in the end.
>>   =20
>>
>
>This is *NOT* good !
>
>If the primary MX performs greylisting, then *ALL* the backup MXes MUST=20
>perform greylisting themselves as well.
>
> =20
>
Unfortunately I don't have control over any secondaries.  Anyone know of=20
a host that will sell me secondary services and implement greylisting? :)


>As a rule of thumb, *ANY* anti-spam measure that exists on a primary MX =
at=20
>SMTP level MUST exist as well on all secondaries. Otherwise secondaries =
are=20
>easy ways to bypass antispam protection for a given domain, and spammers=
 know=20
>that well (some spammers / spambots systematically send to the LOWEST=20
>priority MX to exploit this possible, and alas frequent, security=20
>shortcoming).
>
>And the primary MX should not greylist mail coming from its secondaries =
(they=20
>should be whitelisted), as greyliting secondaries is not only useless bu=
t=20
>also counterproductive.
> =20
>
I know this.  I just havn't whitelisted the IP yet.  Will get onto that

> =20
>
>>Are we seeing an increase in the number of spam sending MTAs that don't
>>give up on the first attempt?
>>   =20
>>
>
>I believe so. And I also have seen a growing number of spams that retry =
after=20
>about a minute. But not longer. Which means that greylisting duration sh=
ould=20
>probably not being set < 2 minutes.
> =20
>

Thanks for the tip! :)

>Cheers.
>
> =20
>


Thanks for thelp help Michael!

Regards
Ray