8.3 Million Emails in 3 Weeks

[squirre777]

Ok, I'll start off by introducing my network. I run a few Server 03 boxes and one Exchange 03 box. I also have GFI MailEssentials 12 running on my Exchange box. My Firewall is a Watchguard X500. My network consists of about 85 users.

The problem I'm having is with spammers bombarding my domain name with spam. I can log into Exchange System Manager and the Queue will routinely have about 5K to 10K emails. I have to shut down SMTP service and let them filter out, but of course with all these emails my end users have a delay on all mail, internal and external. I spoke with GFI tech support who reviewed the logs and they said I indeed had about 8.3 million emails since my last server reboot, about 3 weeks ago.

Reviewing the individual spams, they are all addressed to non existant domain users ie: blahblah@mydomain.org. This is not a relay attack or anything. GFI said that it's doing it's job, which it is very nicely. The problem is the quantity of emails hitting the server. The box is behind the firewall and everything is configured correctly.

GFI said I should look into a mail relay outside of Exchange and run MailEssentials on it to help filter the emails out before hitting Exchange. They said there is no way to block them out because their not relaying, just attacking my actual domain name.

So I guess my question to you guys is this, should i setup another mail server to relay or is there something I can do at the firewall level to get these off my Exchange box?

Thx for your help!

 

[Zelandakh]

Use the AD lookup to drop non existent users, it is a GFi module. 3 million a week isn't actually a lot for that set up.

Postini or MessageLabs might be worth a look though.

 

[squirre777]

I have. GFI is doing an excellent job of filtering out the crud, it's just when 15K emails hit my server in 2 minutes it clogs up exchange for like an hour. I need a way to offload the filtering from my Exchange box.

 

[MrNick0483]

we use the Barracuda filter as our relay with thier exchange accelerator configured that looks up each user on the server via LDAP. If the user is not on the server it rejects the mail without the EX server ever seeing the mail.Our Barracuda rejects around 200,000 emails an hour on average due to bad recipent.

 

[squirre777]

So if I upgraded my Watchguard Firewall with its SpamBlocker I'm assuming I can do the same filtering correct?

 

[58sniper]

Turn on recipient filtering and tar pitting in Exchange

Exchange will deal with all of this just as good as Mail Essentials will.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[squirre777]

Thats my problem though (and I have turned on Rec Filt and tar pit regedit). All these emails are being filtered on the exchange server and it can't handle the load. An Exchange Server shouldn't be able to handle 100,000 emails within a few minutes. My solution is to get the filtering completely off Exchange. MailEssentials is handling the filtering great, it just grabs the mails after hitting Exchange, which is fine with filtering out the crud from users but not simplifying my Exchange load. I want to handle the bulk of them before hitting Exchange. Upgrade my WatchGuard to handle the bad recipients?

 

[Davetoo]

Put a Barracuda in front of the Exchange, let it do all the work. That way the Exchange server will only see email to valid recipients. You also get the added benefit of the spam filtering on the Barracuda in addition to all the rest you have.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

There are no more PDC's! There are DC's with FSMO roles!

 

[squirre777]

That was what I'm thinking. I can get an upgraded Firebox MUCH cheaper than the Barracuda though, I'm just wondering if I can do the same recipient filtering with it. I plan on keeping GFI as I'm getting a 99.7% success rate with my spam, I just want the off-server device to do recipient filtering based on AD or LDAP.

 

[58sniper]

Use a cloud based solution like AppRiver, FrontBridge, Postini, etc. That way, the messages don't even hit your bandwidth.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/