Jeff A. Earickson
jaearick at colby.edu
Tue May 27 15:57:19 IST 2008
I monitor it in my daily reports. If I have somebody with a large
number of connections, I grep my syslogs on both the decoy and primary
MX to see what they are up to. If it is an bvious spam engine, then
I block them on my primary MX and let them play with the "try again
later" high MX.
On Tue, 27 May 2008, Alex Neuman wrote:
> Date: Tue, 27 May 2008 08:49:01 -0500
> From: Alex Neuman <alex at nkpanama.com>
> Reply-To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> To: MailScanner discussion <mailscanner at lists.mailscanner.info>
> Subject: Re: "Nolisting"
> Interesting approach. Do you do anything with the data you (potentially)
> On May 27, 2008, at 7:54 AM, Jeff A. Earickson wrote:
>> I do it the other way around. Our high MX always responds with
>> "400 try again later" via smtptrapd.
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> Before posting, read http://wiki.mailscanner.info/posting
> Support MailScanner development - buy the book off the website!
More information about the MailScanner