Strange load situation

[campbell at cnpapers.com]

Quoting Alex Neuman <alex at nkpanama.com>:

> Steve Campbell escribió:
> > I am getting hit pretty hard by a .netzero.com thing. They are all 
> > being listed as spam, but it would be nice to block them up front in 
> > the access table. I just don't know if anyone receives mail from a 
> > real netzero user, and this wouldn't save a copy. They are all from 
> > varying IPs, so its hard to figure out how to do this without damage.
> If it's sendmail, you could add a tempfail message (I think) like so:
> 
> netzero.com   421 Temporary error - Please call +999 999-9999 for more 
> info or e-mail stevesgmailaddress at gmail.com for more info. Mention error 
> code #PEBKAC when reporting.
> 
> I've had to do these things sometimes in order to weed out (and 
> whitelist) legitimate addresses from otherwise spammy domains / ips.

Great idea!

For now, I went ahead and discarded the domain. I checked for valid senders
first that we have had, and prepended the discard with them.

I figure anyone who needs email from netzero can call me.

There's really a major decision to make on how to block these type of things. I
wish it were easier. These netzero spams were 20% of our entire incoming total
for the day before I blocked them. So I figured something drastic. Blacklisting
is the usual way so I can release them later.

Unfortunately, the load average is back up around 5-7. Spikes go higher. No
incoming drops to 2-3. Looks like some major tuning, but this machine should
handle it's load fine.

Dare I ask - Does Mailscanner cause swapping?(Smily face symbol)

Please don't answer that one.

Thanks,

Steve
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
> 
> Before posting, read http://wiki.mailscanner.info/posting
> 
> Support MailScanner development - buy the book off the website! 
> 




-------------------------------------------------
This mail sent through IMP: http://horde.org/imp/