up vote 1 down vote favorite
share [g+] share [fb]

Over the last few days, I've seen a drastic increase in the amount of blatant spam making it inside of my organization. (Exchange 2003 behind Ironmail, Symantec Mail Security.) My security products are up-to-date and appear to be functioning correctly (aside from, of course, the additional V1agr4 messages). I have looked at the headers and don't see anything out of the ordinary. Exchange is passing mail

Is anybody experiencing this as well? If so, can you provide any insight into how the messages are getting through? Any recommendations on how to prevent?

(I'm asking on my user's behalf; my delete button works just fine, but I'm tired of the complaints...)

link|improve this question
100% accept rate
feedback

4 Answers

up vote 3 down vote accepted

I have seen a spike in rejection and deferals. There has been an increase in emails with domain literals like [192.0.2.14].

Main blocks which work for me:

  • spamhaus.org blacklist (big spike in rejections the last couple of days).
  • Reject all mail which uses a hostname in HELO command.
  • Reject all mail which uses my address is HELO command.
  • Reject all mail which uses a raw ip address (192.0.2.15) in HELO command.
  • Defer all mail when SPF exists and does not allow the address. I check the logs and enable valid address. Based on history, I may change this to reject if IP address doesn't have a valid DNS configuration for an email server.
link|improve this answer
feedback
up vote 2 down vote

We've seen a small increase lately but are unaffected. We use MessageLabs but I've installed Mailcleaner at our end, which is catching all the stuff that's getting past MessageLabs. I've heard that MessageLabs used to be a decent spam filtering service but of course that was before Symantec got their hands on it and did what they do best - run it into the ground.

link|improve this answer
feedback
up vote 1 down vote

We're seeing it as well. We're currently using Postini and the only real options as far as I can see are to ride out the current wave or make your spam filters more aggressive. Of course if you do make your filters more aggressive then you'll have users complaining that they're not getting legitimate emails... go figure.

link|improve this answer
That was my initial conclusion as well. I've opened a case with the vendor, following my "we pay support; make it their problem" strategy. – gWaldo Oct 6 '10 at 15:22
feedback
up vote 0 down vote

We use a mail-filter set up like this in front of our Exchange 2003 system, and have NOT seen a recent increase in spam.

link|improve this answer
Good to know, but I don't think that this will be the time for a change in architecture. I'll keep it in mind, however. – gWaldo Oct 6 '10 at 15:23
1  
No, but perhaps if you get more responses about what IS and IS NOT experiencing an increase, you may be able to isolate the problem better. – Brent Oct 6 '10 at 15:27
Good point. Thanks for the perspective! – gWaldo Oct 6 '10 at 17:00
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.