From: Len Conrad (LConradGo2France.com)
Date: Tue Jul 01 2003 - 19:02:48 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

>This is a question about the above statement. My understanding is that
>the above is indeed how it's supposed to work, but in my experience, about
>25% of the spam we receive is received by our backup MX server, without
>the primary server ever having been contacted. My guess is that the
>spammers perhaps believe that the backup MX server is likely to have less
>stringent anti-spam measures, since it has to forward/relay mail to the
>primary server.

spammers KNOW that all MX hostnames are targets. I waste no energy trying
to guess what spammers believe beyond that.

>That used to be true in our case several years ago when we had our ISP be
>the backup MX server, but when spam started to come through the backup MX
>server

backup MXs, as long as the primary MX is up, are SPAM honeypots, since
almost all the mail that arrives there is illegit. There ought to be some
way to harvest the MTA IPs, sender.domains, etc. that arrive at backup MXs
to be fed into a weighting scheme on the primary MX. (

<item> seen on backup MX, assign negative weight on primary MX.

Len

_____________________________________________________________________
http://MenAndMice.com/DNS-training: Seattle; Chicago; San Jose; Wash DC
IMGate.MEIway.com: anti-spam gateway, effective on 1000's of sites, free

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]