[Exim] Major spam problems...

Top Page
Delete this message
Reply to this message
Author: Chris Dollmont
Date:  
To: exim-users
Subject: [Exim] Major spam problems...
Overview:

We have an existing mail domain which I'll call domain1.com. We
acquired another company and their domain, which I'll call
domain2.com.

Since adding handling of inbound mail for domain2.com, the amount of
spam we have has shot through the roof. This has two impacts:

1) On the outbound mail server, I have hundreds (and in one recent
case, over a thousand) mail messages in the queue that are error
notifications going back to a fake address. These messages have the
classic "<>" To: address. In an attempt to stop these messages, I've
done the following:

ignore_errmsg_errors = yes

I've tried:

ignore_errmsg_errors_after = 2h

Neither of these seems to work--I still have hundreds of messages,
some of which have been in the queue for more than 48 hours. I get
rid of these by executing:

exim -Mrm $(mailq | grep "<>" | awk '{print $3}')

but this is imprecise. :-)

A related question, but not a priority, is why do I have email that's
been in the queue for more than 72 hours when I have
timeout_frozen_after = 3d?

2) On the incoming mail server, we've deprecated all but a couple of
the user@??? addresses. I put:

receiver_verify
receiver_verify_addresses = /etc/exim/valid.recipients

In valid.recipients I have:

*.domain1.com
user@???

Mail for anyuser@??? is still coming in and being processed,
though. We'd like it rejected at this point (a firewall gateway).

Am I overlooking something simple? This is becoming a real problem
because each of thousands of messages a day is being run through
Spamassassin, which is boosting the load on my poor server. If I can
stop the messages at the gateway in problem 2), I can reduce the load
considerably. Problem 1) has the effect of making my queues huge and
hard to handle from and administration standpoint.

TIA for any help.

Chris