Comments on: Spam flood

By: Dennis Krul

Dennis Krul — Fri, 28 Sep 2007 08:39:32 +0000

I’ve had the same problem…

Removing the MX won’t help because lots of mailservers have it cached anyway and it’ll take a while for the changes to propagate.

I just removed the catch-all email address from that particular for a while. That’s the easiest solution.

If you still like to receive mail on some addresses that are currently spammed with mail delivery errors, you should block mail from mailer-daemon@ addresses. If you use postfix you could do something like this.

Put in your main.cf the following line:
smtpd_sender_restrictions = regexp:/etc/postfix/sender_restrictions

And put in /etc/postfix/sender_restrictions:
!/mailer-daemon@/ OK

(haven’t tested this, but should work)

Training the bayesian filter of spamassassin with legitimate mail (mail delivery errors are legitimate) won’t do you any good. So I strongly recommend against that.

By: Thomas

Thomas — Fri, 28 Sep 2007 07:54:27 +0000

Just drop the domain in your mailer’s list of local domains. That will get them a relaying denied double bounce, but hey. (DNS takes to long to flush caches.)

By: Nermal

Nermal — Thu, 27 Sep 2007 21:45:16 +0000

Same thing happened to me today at around the same time after being spam free for 4 years

I’ve told my exim mail server to discard (silently drop) any emails that get over 15 points in spam assassin and that seems to be working nicely.

You might have to collect a few and then feed them to spamassassin with the –spam switch so it knows they are spam.

By: Justin Haygood

Justin Haygood — Thu, 27 Sep 2007 20:56:40 +0000

Maybe add an SPF record? The emails will stop bouncing by mail servers that support it, since they’ll know the originating domain didn’t send the email in the first place.

By: Dave

Dave — Thu, 27 Sep 2007 20:17:37 +0000

Are the emails all going to the same address or to multiple addresses at your domain? Would turning off the “catch all” facility help (so that you only get emails for real accounts rather than anything@yourdomain)?

By: Florian Steinel

Florian Steinel — Thu, 27 Sep 2007 18:25:35 +0000

Something like this?
http://ietfreport.isoc.org/idref/draft-delany-nullmx/

By: ovitters

ovitters — Thu, 27 Sep 2007 17:08:34 +0000

Yeah, often mailsoftware falls back to the A record if no MX can be found. Just set it to 127.0.0.1, or don’t accept mail for that domain.

By: Marcus

Marcus — Thu, 27 Sep 2007 16:34:03 +0000

I have a similar problem from time to time. I am looking at using Sender Policy Framework but haven't got very far with it yet.

By: niq

niq — Thu, 27 Sep 2007 16:04:33 +0000

Set the MX record to 127.0.0.something. Or a private address (192.168.*.* or somesuch).

In the meantime, can your MTA just reject based on recipient address in the envelope address?

By: Paulo Pires

Paulo Pires — Thu, 27 Sep 2007 15:46:04 +0000

Things like deleting DNS records, blocking bounce notifications, bla bla bla.. won’t stop the SPAM.

SMTP Relay and SMTP-Auth are the hint words in this case