Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We've recently been recipient to an increase in spam and I'd like to determine the IP that the spam is coming from. My hope is that it will be coming from a limited number of IPs that I can manually block.

share|improve this question
5  
That's sweet, but also just a little naïve –  Mathias R. Jessen Mar 13 '12 at 19:29
1  
Okay, then perhaps you can suggest a better alternative. –  Windows Ninja Mar 13 '12 at 19:35
    
Look into assp.sourceforge.net for an effective spam filter. Don't use bayesian scanning or at least only as a last resort. Use things such as grey listing, valid HELO checking and rDNS checks. –  aseq Mar 13 '12 at 19:42

1 Answer 1

up vote 6 down vote accepted

The "Received:" headers on the message will give you the source server, as would Exchange's Message Tracking functionality. Having said, it's hopeless to think that you can prevent any significant quantity of spam by manually blocking the IP addresses of SMTP servers sending you messages if you're receiving mail from the Internet.

You'd be better off looking at a third-party hosted or on-premise anti-spam solution, or at the very least, looking at the anti-spam functionality built-in to Exchange (meager, though it is). You absolutely don't stand a chance of keeping up with blocking spam manually.

share|improve this answer
    
Thanks, this is the answer I was looking for. We already have Symantec Mail Security but some domain registrar scams have been finding their way past it recently. I guess I'll need to lower the spam score threshold to see if that will resolve things. Thanks! –  Windows Ninja Mar 13 '12 at 19:44
    
Postini is pretty cheap, couple bucks a mailbox per month, and is a hosted gateway solution so keeps the spam from even hitting your perimeter network. Plus the spooling feature is a godsend when doing maintenance or when there's an unexpected outage. –  gravyface Mar 13 '12 at 19:47
    
Thanks for the recommendation gravyface...I'm going to look into that immediately. –  Windows Ninja Mar 14 '12 at 12:21

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.