Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Since a day or two the mail delivery queue of the hMailServer is exploding because someone is trying to send spam via this server. Though the e-mails aren't successfully sent it fills up the mail queue.

All SMTP connections require smtp-connections and also the log shows '530 Authentication Required'.

Also the mails are sent via a non-existing mail-account. (Service@website.com)

Below images show the queue and a part of the log. enter image description here enter image description here

Is there anyway I can stop the queue from filling up? Auto-ban is enabled but doesn't seem to help.

share|improve this question
    
It looks to me that there are two ip addresses attempting to send the email. Have you tracked down those two ip addresses? Have you tried blocking those two ip addresses with your firewall? –  joeqwerty Mar 6 at 15:54
    
@joeqwerty In this part of the log you indeed see only two or three ip's. Unfortunately the amount of IP's trying to sent mails is way larger than just this few. –  Sebass van Boxel Mar 6 at 16:39

1 Answer 1

up vote 2 down vote accepted
+50

The first thing I would try is to configure some dns RBL, http://www.hmailserver.com/documentation/latest/?page=reference_antispam

If it is correctly implemented you will have messages blocked before the SMTP exchange has begun, and nothing created in the queue. You could begin with spamhaus xbl and/or sbl, there are relatively safe and might greatly help your problem.

The second thing I would do is have a look at the COM api:

You have a DeliveryQueue object which you can use to clear the queue. This might not be the best solution but it's always better to script it and run it on a scheduled task than having to open the gui and click manually on "Clear Queue". Once you have a basic script you can enhance it, for example by running the Clear() only if the queue size is above a certain threshold..

Then if the incoming traffic is so high that even with some good DNS RBLs and big automated clearing of the queue your server can not stand the traffic I would look for setting up an MX server somewhere else and configure it to shield your server from such attacks. A lot of unix-based server will probably handle these situations more efficiently, and you can have one on a vps for a small monthly amount.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.