spam to secondary MX

[mufka]

It seems that the spammers are becoming more intelligent. I have a sendmail server acting as a spam filter with dnsbl. It is the primary MX for the domain. I am finding that some spam still gets through and when i look at the headers, it is going directly to the secondary MX which doesn't have filters.

The spam filter is acting as a relay, forwarding any legitimate email to the second server. I want to keep the second server in as an MX record in case the spam filter dies.

Anyone had any experience with this and how to combat it?

I have tried a suggestion of putting 3 MX records in, the first and third being the spam filter and the second being the destinaton server. The idea here was that if the spam software was trying the first or last MX record, it would get caught not trying any in the middle.

 

[jad]

no matter which you used they'd find you.

the non-spam mailer will need to not receive mail from the outside world. you could ipfilter it, or choose a different form of spam tool.

we've found a new tool called MailScanner, which seems to work well at the moment. but it'll replace your current spam scanner.

it works by sitting on the same machine, running as a daemon. you run sendmail -bd (no queue timeout) and the MailScanner picks up the files from /var/spool/mqueue scans them and stores them somewhere like /var/spool/mqueue.out and will then tell sendmail to run the queue from this location instead '/lib/sendmail -oQ/var/spool/mqueue.out -q' or something similar.

if you want it i can probably find the url.

 

[mothachucker]

A possible solution is three servers. The first two are spam filters with mx records. The third does not have an mx record. Mail is relayed to the third server by the first and second servers. This provides a backup to recieve mail if one of the spam filters dies. You can force a relay by domain to a specific host (third server) by using mailertable.