Multi (split) image spam

[Richard Frovarp]

Scott Silva wrote:
> Res spake the following on 5/6/2007 3:25 PM:
>   
>> On Sun, 6 May 2007, Andrew MacLachlan wrote:
>>
>>     
>>> Some of the spammers are doing resends though to get around greylisting
>>>       
>> This is one of the reasons I consider greylisting useless :)
>> I've seen this from this part of the world (oceania/asia area) for about
>> as long as greylisting came about.
>>
>> It's the same ol same ol, we do something to stop em, they circumvent
>> it, we counter it and they will try counter it again, and so on and as
>> grey listing is the most simplest thing to get around, i've always
>> regarded it as a joke, and all it does it build up your own outgoing
>> queues, this might be fine for those who do 1K messages a day but when
>> you do millions,
>> thats just not on, anyhow you might as well firewall off your primary MX
>> making mail fail and force resend via secondary MX's.
>>
>>
>>     
> That won't even help, as most of my spam goes straight for the secondaries anyway.
>
>   

Our primary is firewalled off. I have no clue as to how much spam it 
blocks. However, we have allowed the three large internal networks to go 
through the firewall. We did this because we were getting too much spam 
and our incoming queues were building up. People kind of expect that 
mail from the person sitting next to them to come through pretty 
quickly, and we were having trouble making that happen. Since our 
primary only processes mail from the networks my organization is 
associated with (the state, k12, and higher ed networks in the state), 
it can fire mail through very quickly. It might not be effective for 
stopping spam, but it certainly can help with processing delays of local 
mail.

A subsequent upgrade to milter-greylist 3.0 resulted in massive speed 
improvements on the other machines to pretty much remove the queue build up.