I need some advice on setting up a secondary MX for some domains not handled by me. So far, I've used my mail server (qmail+vpopmail+simscan+clamav+spamassassin+chkuser) by adding the domains in question to the rcpthosts file. It works, but even with virus and spam filters I'm left with a lot of junk, mainly because there is no valid user check involved for those domains.

The main reason for setting up this secondary MX is to have a place for mail to go to when the mailserver that's supposed to receive them is down. It works, but there is a downside: my email server is leaking a lot of junk email, because it is being used to spread spam by sending mails to inexistent users on those domains with valid return addresses. The primary MX refuses the messages, and so they get bounced; exactly what the spammers intended in the first place. And this gets my mail server blacklisted, thus hurting all my users.


The questions are:
1. what are the options for checking if the user is valid and has not reached it's quota for a setup like mine?
2. how can I stop sending back the emails that the primary MX rejects?

I know there is a solution out there that would cut down spam drastically if it were used by everyone: SPF. Unfortunately, it's not. So in my case it can't help, and I can't afford to reject mail that doesn't explicitly pass SPF check. So far I've only come up with one scenario that would help somehow: setting up the secondary MX on another server that doesn't run an MTA at the moment, so if it gets blacklisted it won't affect my users. However, getting the secondary MX blacklisted would hurt the domains in question in case of a primary MX failure, i.e. exactly when it's needed the most. I thought of a workaround: filtering with a firewall connections to remote port TCP/25 initiated to destinations other than the primary MX. This would stop the spreading of spam, but I would still end up with a huge qmail queue, and the secondary MX would still see a lot of traffic (the spam doesn't get out, but it still gets in). And still, there are blacklists out there that check if your server accepts mails for inexistent users on your domains, and will still blacklist you even if not a single "illegitimate" message was
sent from your ip.

I'm sorry that this is not a genuine vpopmail issue, and thus not worthy of being broadcasted on this mailing list, but after reading the [vchkpw] messages for the past few years, I couldn't think of a better community to address this to.

Bogdan

!DSPAM:47c44631310541107021153!

Reply via email to