[Mimedefang] Spam sneaking in through secondary MX??

[John]

At 08:49 AM 4/11/03, you wrote:
>This may be a bit off topic but I've noticed spam passing through an
>SMTP gateway that is a fallback to the fallback gateway.  I have weights
>of 10, 20 & 30 on 3 MX exchanges.  It seems unlikely that the 10 & 20
>weight MX records would be unresponsive, which is what I thought would
>have to happen for mail to fallback to the 3rd exchange.  The third
>gateway by the way does not do Spam or virus filtering.  Do spammers
>purposely seek out secondary exchanges to use or are my other two
>gateways failing and mail going to the third one?

Spammers have always tried to find an edge.  One of them is testing the 
list of MX's and seeing which one they have success with.  Many times a 
second or third MX is not in direct control of the main MX.  Therefor   may 
have different access settings and SPAM features like your 3rd MX.  I do 
secondary MX for a friend and initially he complained about bouncing mail 
when his server was down rather then Queuing it.  My servers have very 
tight access files along with many blocked /8's and 16's causing him to get 
some rejections.  However, I have seen the Spammers on a regular basis 
still trying to climb MX's to get in.  Since both my primary and secondary 
have identical access files and other SPAM things, failure on my primary 
and secondary are identical.  If they cannot get into the primary and try 
climbing into my secondary, the results are the same.

If you have control over your primary and secondary, and not your tertiary, 
I'd drop number 3 in a heart beat <G>


>Inquiring minds want to know...
>
>_______________________________________________
>
>James Whittington
>Systems Administrator
>
>Excelorant, LLC
>A TM Floyd Affiliate Company
>1800 St. Julian Place
>P.O. Box 8263
>Columbia, SC 29202
>
>803.765.1310 | Phone
>800.780.1170 | Toll Free
>803.765.1431 | Fax
>
>jwhittington at excelorant.com
>
>_______________________________________________
>
>
>
>_______________________________________________
>MIMEDefang mailing list
>MIMEDefang at lists.roaringpenguin.com
>http://lists.roaringpenguin.com/mailman/listinfo/mimedefang


John Jaeger - Billings, Montana

EMail To	: <mailto:john at jjgb.com>
Home Page	: <http://www.jjgb.com>

PGP:
RSA Key ID: 0xAAEC7751  <http://www.jjgb.com/public_files/RSA_Key.zip>

"Our liberty is protected by four boxes...
     The ballot box, the jury box, the soap box, and the cartridge box."
                                    - Anonymous