4

I have a dedicated Ubuntu Lucid box at a hosting provider that is my backup MX (running exim4 4.71-3ubuntu1.4) for domains that I have configured on an Exchange 2007 server on my LAN. So my Exim server is the relay, and if my Exchange server or ISP connection goes down, the Exim server caches it all up and will relay it to me when everything is back up.

So the problem is that my Exim server accepts all addresses @mydomain.com whether they're valid or not, and then when my Exchange server rejects email based on bogus sender, spammy content, or whatever, the Exim server is stuck in the middle holding the bounce. Of course spammers don't use valid sender addresses, so now my Exim server's queue is all junked up with backscatter bounces that it can't deliver.

(In the past, I've used the :fail: alias to fail delivery to non-existent users outright, but since this guy is an intermediate hop, he doesn't know anything about which mailboxes are valid and which are not.)

So, what do I do about it?

  1. Just ignore it and the messages will eventually time out and be dropped? Could this be deleterious to my IP's spam reputation?
  2. Figure out a way to TCP/IP proxy the mail connection directly from my hosted server to my Exchange server (thus eliminating the backup cache feature?)?
  3. Put spamassassin on my hosted server to block the majority of spam during the initial connection, thus rejecting the email outright, thus no NDRs?
  4. Something else that I haven't thought of?

Any suggestions for accomplishing this are greatly appreciated. Thanks.

Improve this question

2 Answers 2

Reset to default
3

IMHO, your best option is using an exim/spamassassin combination, cofigured to reject mail at STMP time (i.e. before accepting it) to mitigate backscatter.

Add in some RBL whitelisting/blacklisting to refuse or (better?) greylist inbound mail at connection time.

This should be sufficient to reduce the queue size.

There's lots of info on how to configure exim+spamassassin, as a start take a look here.

Improve this answer
2
  • Adding sources of info to the above good advice: For links on spamassassin and greylisting: github.com/Exim/exim/wiki/HowTo#spam-filtering. For links on various ACL stanzas for mitigating spam and configurations of spamassassin: github.com/Exim/exim/wiki/SpamFiltering. I personally use the Memcached+perl greylisting method, but if you only have one standalone mail server, any of the other greylisting methods are just fine.
    – Todd Lyons
    Apr 24, 2013 at 14:00
  • Yeah, I'm actually doing exactly that for a different system, and I didn't think about doing it here until I was typing up my question. I think this is the best option as well, but I just wanted to make sure you all agreed without biasing the question. Thanks.
    – Jon Heese
    Apr 24, 2013 at 14:53
1
  1. Periodically export list of valid SMTP addresses from your primary mail server
    I did it myself with older MS Exchange version -> I assume it should be possible with your version
  2. Make your secondary MX/gateway reject messages to unlisted addresses in the domain
  3. Reject spam anyway in SMTP session - see milter-like spam rejection with Exim

There are means to ask MS Exchange about valid addresses in real time but I would suggest to prefer version capable to work when MS Exchange is off-line.

P.S. I case of problems use magic words "sendmail can do it" to get free support from Exim experts ;-)

Improve this answer
3
  • 1
    Exim can easily be configured to reject unwanted mail at STMP time (i.e. with 55X codes) before accepting and queueing it.
    – Daniele Santi
    Apr 24, 2013 at 10:54
  • I have not been sure about body based rejects in SMTP session. Exim seems to offer milter equivalent in in this area utcc.utoronto.ca/~cks/space/blog/sysadmin/EximMilterHookup
    – AnFi
    Apr 24, 2013 at 11:10
  • Yeah, see there's a problem with that strategy... I have a catch-all setup on one of my Exchange-hosted domains (with SpamAssassin on my Exchange server filtering out the junk), so for that one domain, all addresses are "valid". That's why I didn't include that option in my list. Sorry for not mentioning the catch-all in the original question-- it was late when I posted.
    – Jon Heese
    Apr 24, 2013 at 14:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .