Backup Sendmail MTA issue, design with other server?

[IRLASCHU]

Hi everyone,

I have an issue with an email system at the moment and hope someone could help/give advice on how-to work forward with the email system we have.

One year ago an IT contractor setup for the company one new email server, replacing two old servers. The new server is "SME Server Linux Server Distribution" from

http://www.smeserver.org.

We had such a spamming issue that "Anti-Spam SMTP Proxy ->

http://assp.sourceforge.net

" was build into the distro.

There server is based on QMail and works wonderfully. We did find that if the server was overloaded with TCP connections or emails started queuing due to many emails being processed at any one given time; customer emails would not be processed on time to be delivered. We investigated for months the issue and we ruled out the network, hardware, DNS, rDNS and came to the conclusion we where receiving so many emails, aprox. 20,000 per day and 99 percent spam. To filter this for each mailbox we used “Anti-Spam SMTP Proxy”. This works great from an end user point of view but still the server needs to process all the emails.

We decided to setup a backup email server, a MTA on another location for backup running CentOS 5 with Sendmail.
The IT Contractor I got to do this guaranteed that it will route all emails that have accounts on SME with the right domain, will forward back to SME once SME came back online and if the primary SME server dropped out for what ever reason, the Sendmail MTA will hold all emails.

After my own investigation, testing, I took the SME Server offline, I found the Sendmail Server did not hold the emails received and did not forward any emails received back to the SME server. I spoke to the contactor and found the person did not want to talk about this!
I flew to our UK office and meet him on-site, explained this is unacceptable. The contractor is reviewing the setup but is then simple not coming back to me even after an agreed timeframe.

I’m a Linux user myself and look after all the IT; I’m not a Sendmail expert and would be great full if you can help me see if we can get Sendmail to

1) Sendmail act as a backup MTA for the other server
2) Store and forward emails only that belong to our domains or even if possible mailbox’s on the other server.
3) Once other primary server come back online, or can process the emails, Sendmail will then forward the emails.


Or is there a better why of doing this?

Thanks
IRLASCHU

 

[jkupski]

Sendmail is perfectly capable of what you want to do, and the configuration is fairly simple. Googling for 'sendmail backup mx' will return a plethora of hits that should point you in the right direction.

However, here are some (related and unrelated) thoughts:

1. It's a fairly common spammer tactic to hit the secondary MX servers instead of the primaries. The reasoning behind this is that most secondaries will not be running the same level of antispam/antivirus/etc protection, so there is a greater chance of their payloads leaking through. Realize that if you implement a secondary MX, it will probably be equally overloaded, and for the same reason.

2. qmail on one system, sendmail on another? Why bother having to deal with two separate ways of doing things if you don't need to? Run qmail on the secondary MX unless you have a good reason not to.

3. Instead of trying to take the load off with a backup MX, consider going with a multi-tiered approach--one mail server to host mailboxes and relay outgoing messages, and one or more servers front-ending that box in a round robin setup doing your anti-spam.

4. Go with an appliance? I think the era of DIY anti-spam (at anything other than the ISP level, or someone else who handles a similarly large amount of mail) is probably coming to an end (take a look at the amount of traffic on the spamassassin lists these days and compare it to a few years ago to see what I'm talking about) because so many vendors are now doing it fairly well, and for not very much money. Someone like Barracuda, Sonicwall, Ironport, etc, might be able to do what you want to do cheaper (overall) than doing it in house.

In any case, good luck.