Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

few days ago some kind of botnet attack started on my mail server which tries to send a lot of spam emails to certain domains on my mail server. Biggest issue here is that almost every attacker IP address is different. I've checked log from one day and it contains about 73000 different IP addresses. I've disabled catch-all accounts but it has not helped. Any ideas?

Thanks in advance

share|improve this question
up vote 1 down vote accepted

You need to have an RBL list checking on your firewall or get your ISP involved. You can't stop a DDOS attack at the server. Most firewalls can check an incoming smtp connection against one or more RBLs. At least then, the connection is dropped immediately and no more resources are wasted. Your ISP might be able to help here also. Our Sonicwall firewalls have this capability, and we have noticed a large decrease in load on our mailserver because of it.

share|improve this answer
I was wondering. Do you think I could defend myself against this attack using DNS server with blacklist plugin? – GrZeCh Sep 5 '09 at 20:03
What blacklist plugin would you use? I suppose if it responded to blacklisted IPs with a bogus MX response, that would take the load off of your mail server... Never used one though. We prefer to stop all SMTP traffic at the firewall if the IP is listed in an RBL. – Scott Lundberg Sep 6 '09 at 1:25
I'm using Simple DNS server which with 5.2 version has this plugin: Ignore DNS Request Plug-In - and allows to block MX IP resolving if requesting IP is in RBL list. Right now I'm using 5.1 version and I'm considering upgrading to 5.2 – GrZeCh Sep 7 '09 at 17:24

add the following capabilities to your mailserver

  • greylisting
  • sender policy framework -
  • rbls - at least spamhaus

further more, there are fine tune settings which can be made @ MTA level (header/body checks, etc)

share|improve this answer
My problem is actually not SPAM itself but a lot of connections from different IP addresses to SMTP server where error is "No such user here". Greylisting enabled, SPF and rbls too. But they are basically spam filtering methods. – GrZeCh Sep 5 '09 at 10:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.