SOBER-I

[Alan Cragg - Lists]

Thanks,

That looks like a great idea. I went through this once before (Sober-G)
with our ISP and they wouldn't do anything to help us even though the
offending user/computer was on their network. 

I will give this a shot.

Alan

 
 	  	
                 Alan Cragg	
                 I.T. Manager	
 	  	
                 9 Burbidge Street               tel:    (604) 472-2412	
                 Coquitlam BC            fax:    (604) 472-2345	
                 Canada V3K 7B2          pager:  (604) 622-3370	
                                         acragg at vsmmedtech.com	
                 http://www.vsmmedtech.com/	  	

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On
Behalf Of Vlad Mazek
Sent: Tuesday, November 23, 2004 12:24 PM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Re: SOBER-I

>Does anyone know of a better way to block this without having to block
>our secondary mail server?
>Is it a performance tuning issue? We are using MailScanner 4.35.11 and
>Sophos AV, not SAVI, and SA 3.0.1.
>
>
We provide a lot of ETRN/ATRN servers and here is what we advise our
customers to do: Never place ETRN server as the lowest priority MX for
your domain. Most spammers will target the ETRN server as it usually
blindly accepts mail. Instead place the ETRN server in the middle, for
example:

in   mx   10   mail.mazek.com.
in   mx   50   etrn.myisp.com.
in   mx   100   etrn.mazek.com.

where mail.mazek.com and etrn.mazek.com are the exact same server.

This way you take the the ETRN server out of the loop unless your T1
goes down in which case mail will go to your ETRN server.

Hope that helps.

-Vlad Mazek

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!





CONFIDENTIALITY NOTICE. 
The information contained in this communication is confidential and/or 
proprietary business or technical data. If you are not the intended 
recipient, you are hereby notified that any use, dissemination, copying 
or distribution of this communication is strictly prohibited. If you  
have received this communication in error, please immediately notify us by 
telephone (604) 472-2300, or electronically by return message, and 
delete or destroy all copies.

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the MAQ (http://www.mailscanner.biz/maq/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!