John wrote:
They are correct in the way Qmail itself works. I've personally confirmed a couple of these points with other users on the Spamassasin mailing list (as far as when the MX fails it doesn't try another, etc.). And what they mean is that if the first server they contact doesn't answer, or if the SMTP session is aborted during the handshake sequence then the server is supposed to try the next MX up. I imagine they're using some sort of patched greylisting, where they have a MX that just says "sorry, can't accept" so a "proper" server will try the next machine up. The older (and I say older, and mean it) spamming software would only try once to deliver a message to a user and then never again. Which is why greylisting works. If the mail doesn't pass the filters in the above example, your server has already delivered it so as far as it's concerned all is well. It doesn't know they're deleting it due to Spamassasin rules or anything.I found this on wiki.ctyme.com: --------------------------------Qmail is a popular MTA (Mail Transfer Agent) but it has a serious flaw where is doesn't obey the rules when it comes to retrying other servers when it receives a temporary error. Domains advertise multiple MX records with priority numbers. The higher the number the lower the priority (go figure). So mail servers are supposed to try the lowest MX record first, then if that fails try the higher numbered MX servers. Qmail is written so that if the lowest MX record returns a temporary error then it refuses to try any of the other MX records and will continue to talk to the same server till it times out and reject the email. There is a patch available to fix this by the author of Qmail refuses to include it in the distributed product. If you must use Qmail we encourage you to use this patch. If you are selecting a MTA, Exim is far better. The problem this creates is that suspicious hosts are deferred on our lowest MX but accepted on the second MX. So huge amounts of spam are turned away while good email is only temporarily rejected but will be accepted if the retry on the second level that has different rules. Qmail doesn't return and therefore isn't compatible with this system.---------------------------------Is it just me, or is there something wrong with this logic? When they say "mail servers are supposed to try the lowest MX record first, then if that fails try the higher numbered MX servers," do they mean server down so try the next one, or do they mean the email didn't pass the mail filters on the priority mail server so try the next one? If that's the case, why would you implement one set of rules on one server and a different set of rules on the backup server (besides resource limitations, which would say a lot about this hosting company)?Is anybody familiar with this patch or why one would apply it?
Hopefully that answers some of your questions.
smime.p7s
Description: S/MIME Cryptographic Signature
