[Mimedefang] Many many MX records

[Kayne Kruse]

> Today I saw an email flood that was sending to our mail filter and 
> directly to the mail server.  Both have MX records for the 
> domain, with 
> the filter just having a lower preference value.  The traffic 
> was coming 
> from a number of cable modem sites.  MD was successfully 
> tempfailiing it 
> and it never seemed to retry.  The flood almost looked like 
> they were just 
> picking an MX record without regard for preference.  
> 

I have seen these activities for quite sometime, seems some just pick the
lowest priority.  Since I have 2 MD servers, for failover, often wonder why
alot of the traffic is hitting there.  I would go as far to say most
legitimate activity runs through our primary.  I think their logic is the
lowest priority MX record means they have a more successful rate of sending
spam through, which is not the case.  They are nearly identical setups,
except for the ip/hosts they reside on.  The backup machine is not powerful,
but still. 

Kayne