Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a dedicated Ubuntu Lucid box at a hosting provider that is my backup MX (running exim4 4.71-3ubuntu1.4) for domains that I have configured on an Exchange 2007 server on my LAN. So my Exim server is the relay, and if my Exchange server or ISP connection goes down, the Exim server caches it all up and will relay it to me when everything is back up.

So the problem is that my Exim server accepts all addresses @mydomain.com whether they're valid or not, and then when my Exchange server rejects email based on bogus sender, spammy content, or whatever, the Exim server is stuck in the middle holding the bounce. Of course spammers don't use valid sender addresses, so now my Exim server's queue is all junked up with backscatter bounces that it can't deliver.

(In the past, I've used the :fail: alias to fail delivery to non-existent users outright, but since this guy is an intermediate hop, he doesn't know anything about which mailboxes are valid and which are not.)

So, what do I do about it?

  1. Just ignore it and the messages will eventually time out and be dropped? Could this be deleterious to my IP's spam reputation?
  2. Figure out a way to TCP/IP proxy the mail connection directly from my hosted server to my Exchange server (thus eliminating the backup cache feature?)?
  3. Put spamassassin on my hosted server to block the majority of spam during the initial connection, thus rejecting the email outright, thus no NDRs?
  4. Something else that I haven't thought of?

Any suggestions for accomplishing this are greatly appreciated. Thanks.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

IMHO, your best option is using an exim/spamassassin combination, cofigured to reject mail at STMP time (i.e. before accepting it) to mitigate backscatter.

Add in some RBL whitelisting/blacklisting to refuse or (better?) greylist inbound mail at connection time.

This should be sufficient to reduce the queue size.

There's lots of info on how to configure exim+spamassassin, as a start take a look here.

share|improve this answer
    
Adding sources of info to the above good advice: For links on spamassassin and greylisting: github.com/Exim/exim/wiki/HowTo#spam-filtering. For links on various ACL stanzas for mitigating spam and configurations of spamassassin: github.com/Exim/exim/wiki/SpamFiltering. I personally use the Memcached+perl greylisting method, but if you only have one standalone mail server, any of the other greylisting methods are just fine. –  Todd Lyons Apr 24 '13 at 14:00
    
Yeah, I'm actually doing exactly that for a different system, and I didn't think about doing it here until I was typing up my question. I think this is the best option as well, but I just wanted to make sure you all agreed without biasing the question. Thanks. –  Jon Heese Apr 24 '13 at 14:53
add comment
  1. Periodically export list of valid SMTP addresses from your primary mail server
    I did it myself with older MS Exchange version -> I assume it should be possible with your version
  2. Make your secondary MX/gateway reject messages to unlisted addresses in the domain
  3. Reject spam anyway in SMTP session - see milter-like spam rejection with Exim

There are means to ask MS Exchange about valid addresses in real time but I would suggest to prefer version capable to work when MS Exchange is off-line.

P.S. I case of problems use magic words "sendmail can do it" to get free support from Exim experts ;-)

share|improve this answer
1  
Exim can easily be configured to reject unwanted mail at STMP time (i.e. with 55X codes) before accepting and queueing it. –  Mr Shunz Apr 24 '13 at 10:54
    
I have not been sure about body based rejects in SMTP session. Exim seems to offer milter equivalent in in this area utcc.utoronto.ca/~cks/space/blog/sysadmin/EximMilterHookup –  Andrzej A. Filip Apr 24 '13 at 11:10
    
Yeah, see there's a problem with that strategy... I have a catch-all setup on one of my Exchange-hosted domains (with SpamAssassin on my Exchange server filtering out the junk), so for that one domain, all addresses are "valid". That's why I didn't include that option in my list. Sorry for not mentioning the catch-all in the original question-- it was late when I posted. –  Jon Heese Apr 24 '13 at 14:55
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.