Strange load situation

[Dennis Willson]

netzero publishes SPF records. So you could filter on that if you use 
some form of SPF filter. Also have you tried greylistiing? Works well 
for me.

campbell at cnpapers.com wrote:

>Quoting Alex Neuman <alex at nkpanama.com>:
>
>  
>
>>Steve Campbell escribió:
>>    
>>
>>>I am getting hit pretty hard by a .netzero.com thing. They are all 
>>>being listed as spam, but it would be nice to block them up front in 
>>>the access table. I just don't know if anyone receives mail from a 
>>>real netzero user, and this wouldn't save a copy. They are all from 
>>>varying IPs, so its hard to figure out how to do this without damage.
>>>      
>>>
>>If it's sendmail, you could add a tempfail message (I think) like so:
>>
>>netzero.com   421 Temporary error - Please call +999 999-9999 for more 
>>info or e-mail stevesgmailaddress at gmail.com for more info. Mention error 
>>code #PEBKAC when reporting.
>>
>>I've had to do these things sometimes in order to weed out (and 
>>whitelist) legitimate addresses from otherwise spammy domains / ips.
>>    
>>
>
>Great idea!
>
>For now, I went ahead and discarded the domain. I checked for valid senders
>first that we have had, and prepended the discard with them.
>
>I figure anyone who needs email from netzero can call me.
>
>There's really a major decision to make on how to block these type of things. I
>wish it were easier. These netzero spams were 20% of our entire incoming total
>for the day before I blocked them. So I figured something drastic. Blacklisting
>is the usual way so I can release them later.
>
>Unfortunately, the load average is back up around 5-7. Spikes go higher. No
>incoming drops to 2-3. Looks like some major tuning, but this machine should
>handle it's load fine.
>
>Dare I ask - Does Mailscanner cause swapping?(Smily face symbol)
>
>Please don't answer that one.
>
>Thanks,
>
>Steve
>  
>
>>-- 
>>MailScanner mailing list
>>mailscanner at lists.mailscanner.info
>>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>
>>Before posting, read http://wiki.mailscanner.info/posting
>>
>>Support MailScanner development - buy the book off the website! 
>>
>>    
>>
>
>
>
>
>-------------------------------------------------
>This mail sent through IMP: http://horde.org/imp/
>  
>

-- 

----------------------------------
Dennis Willson
mailto:taz at taz-mania.com
http://www.taz-mania.com

Owner / Operator, Kepnet Internet Services



-------------- next part --------------
A non-text attachment was scrubbed...
Name: taz.vcf
Type: text/x-vcard
Size: 219 bytes
Desc: not available
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20060615/478c8b07/taz.vcf