Strange load situation

[Steve Campbell]

Dennis,

----- Original Message ----- 
From: "Dennis Willson" <taz at taz-mania.com>
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Sent: Thursday, June 15, 2006 8:24 PM
Subject: Re: Strange load situation


> netzero publishes SPF records. So you could filter on that if you use
> some form of SPF filter. Also have you tried greylistiing? Works well
> for me.

How did you implement the SPF filter? Is it configurable for just specific 
domains or all-or-nothing?
What do you use for greylisting also? I know of the milters for both from 
Snert, but are there others?

Thanks very much.

Steve
>
> campbell at cnpapers.com wrote:
>
>>Quoting Alex Neuman <alex at nkpanama.com>:
>>
>>
>>
>>>Steve Campbell escribió:
>>>
>>>
>>>>I am getting hit pretty hard by a .netzero.com thing. They are all
>>>>being listed as spam, but it would be nice to block them up front in
>>>>the access table. I just don't know if anyone receives mail from a
>>>>real netzero user, and this wouldn't save a copy. They are all from
>>>>varying IPs, so its hard to figure out how to do this without damage.
>>>>
>>>>
>>>If it's sendmail, you could add a tempfail message (I think) like so:
>>>
>>>netzero.com   421 Temporary error - Please call +999 999-9999 for more
>>>info or e-mail stevesgmailaddress at gmail.com for more info. Mention error
>>>code #PEBKAC when reporting.
>>>
>>>I've had to do these things sometimes in order to weed out (and
>>>whitelist) legitimate addresses from otherwise spammy domains / ips.
>>>
>>>
>>
>>Great idea!
>>
>>For now, I went ahead and discarded the domain. I checked for valid 
>>senders
>>first that we have had, and prepended the discard with them.
>>
>>I figure anyone who needs email from netzero can call me.
>>
>>There's really a major decision to make on how to block these type of 
>>things. I
>>wish it were easier. These netzero spams were 20% of our entire incoming 
>>total
>>for the day before I blocked them. So I figured something drastic. 
>>Blacklisting
>>is the usual way so I can release them later.
>>
>>Unfortunately, the load average is back up around 5-7. Spikes go higher. 
>>No
>>incoming drops to 2-3. Looks like some major tuning, but this machine 
>>should
>>handle it's load fine.
>>
>>Dare I ask - Does Mailscanner cause swapping?(Smily face symbol)
>>
>>Please don't answer that one.
>>
>>Thanks,
>>
>>Steve
>>
>>
>>>-- 
>>>MailScanner mailing list
>>>mailscanner at lists.mailscanner.info
>>>http://lists.mailscanner.info/mailman/listinfo/mailscanner
>>>
>>>Before posting, read http://wiki.mailscanner.info/posting
>>>
>>>Support MailScanner development - buy the book off the website!
>>>
>>>
>>>
>>
>>
>>
>>
>>-------------------------------------------------
>>This mail sent through IMP: http://horde.org/imp/
>>
>>
>
> -- 
>
> ----------------------------------
> Dennis Willson
> mailto:taz at taz-mania.com
> http://www.taz-mania.com
>
> Owner / Operator, Kepnet Internet Services
>
>
>
>


--------------------------------------------------------------------------------


> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>