Anti-Spam

[#1]

Hi all,
email is being delivered tho SMTP feed to IP and use finger postmaster@autoturn.plus.net to dequeue messages that couldn't be delivered say when the server is down.
Since implementing Exclaimer (http://www.exclaimer.co.uk) as an antispam solition on our SBS2003 box running exchange, that rejects as spam with an RFC 2821 complient response for messages such as where the recipient is not in AD, it seems though that these messages are being retained in the queue.
Last week during a brief internet outage, genuine, non-spam messages were also queued and didn't arrive for several days.
I read (here - http://community.plus.net/forum/index.php/topic,58003.0.html) that it's OK to remove mx.last.plus.net but wouldn't that stop genuine messages being queued and here (http://community.plus.net/forum/index.php/topic,61891.0.html) someone suggests being able to view the smtp queue but that wasn't specifically addressed.
What's the thoughs on not having a backup mx - is this sensible?
Anyone have any suggestions as to how to deal with this?
Kind regards
JH

[#2]

Messages are being retained in the autoturn queue because your server is deferring messages and not using a rejection code.
Deferred messages are retained, as it may be that your server is a grey-listing solution, or that it's under heavy load and would rather not receive it just yet.

[#3]

Hi Phil,
Many Thanks for your quick response ... I understand what you mean about the server defering messages rather than using a rejection code.
At the moment the server is under heavy load as I'm currently dequeueing the messages and it's not in its usually running state. In order to dequeue the messages, I've stopped the Anti-Spam software (actually I've put it in to a quarentine mode rather than in it's rejection mode) Is this what you mean by grey-listing? - if not, can you elaborate please
There are still around 1000 messages, when I put it back in to it's "rejection mode" is it possible for you to check that messages aren't being defered still?
Kind regards
JH

[#4]

I'm guessing Phil is saying that Exclaimer is giving a 4xx code (not now error) rather than a 5xx (get lost error).
Also possible is that a 5xx error is given, but because spammers don't observe the RFC's they are also trying the other MX records.
If you think you can do without mx.last I suggest you remove it.

[#5]

Quote from: jelv

If you think you can do without mx.last I suggest you remove it.

Hi Jelv,
Thanks for the reply - very usefull to have the meaning to the codes (i.e. 400 - not now and 500 get lost!)...  As I understand it, when in "rejection mode" Exclaimer does issue a 550 rejection - however at the time Phil looked, I was dequeuing about 2000 messages (from what I could tell, all was spam) so when he looked, i'd have thought it was very probably that there were "defered" or 4xx's due to the heavy load (and it wouldn't have been 500 because it wasn't rejecting anything at the time)
I've spoke to PN's biz support about why the messages were mounting up and to see if they could elaborate factually on what was happening further to Phil's post that indecated he could see what was happening but they weren't able to help much.
If in it's normal running i'm defering messages then ofcourse I need to look at our server (either the exchange server it's self, the router possibly or Exclaimer) but I can't (or don't know how, without PN's help) monitor the trafic comming in to be able to tell
In addition to this, a PN tech last week said that the messages that were queued were all "SPAM or Recipient Not In AD" - Exclaimer marks bounced messages with these two statements which makes me think 1) PN can see what's occuring and 2) Atleast some of the queued messages are ones that's been bounced if that makes any sense.
Given that our systems could be causing the problem, if i do remove the mx.last record (certainly a consideration) I'd just be loosing control or visibility of the situation and I'm concerned that genuine messages could be returned to the conecting mail server and then missed.
As I understand it, if you don't use a backup MX record then any message sent while the server is not contactable will get returned to the origionating mail server that could handle it in any number of ways from re-trying to send the message for a given period to forgetting about it completely and the sender never being notified. Am I correct in this?
Autoturn has always been a great "comfort" - I've known that if our server goes down for any reason then anything sent to us will be recieved when the problem is resolved, but now, I'm not sure if that is "trapping" genuine messages in a pile of spam that can't be cleared
Any thoughts/advice most greatly appreciated.
Regards
JH

[#6]

Another factor to consider is that some spammers deliberately ignore the first MX record and try the later ones figuring that the level of protection may be lower - that is another reason for removing mx.last.
What you have assumed is correct. If you only had the single mx record and the server was down what should happen is that a sender tries to contact your server, gets no response, delays for a period and tries again, this should happen several times over a period of days before it gives up. Most servers will send a "message delayed but you don't need to do anything" message back to the sender. I'd be surprised if any genuine email for was not handled in this way and only junk would disappear down a black hole - I'd guess you wouldn't be too worried about that!

[#7]

Hi jelv/all
Still working on this ...
Before I remove the mx.last record, should i have more than one MX record, currently the domain name is set to deliver mail to IP but in the DNS records, should I also have an MX record for my IP with a lower priority than that for mx.last.plus.net.

Cheers
JH