At 8:29 am +0100 2004/05/20, Alun wrote:
>Giuliano Gavazzi said, in message
> :
> >
>> My finding are thus: an hour (the TTL) after I added the fake MX I
>> had the first spammer hit (fortunately the firewall rule was logged).
>> In 24 hours I had 1500 attempts, in the same period I got about 1300
>> rejections to the primary (this does not include spam that is dropped
>> thanks to the SMTP delays introduced for low scoring emails).
>
>Thanks for that! In that case I'm definitely going to have a play
>with fake secondaries here.
>
mind, have it a temporary error (so defer and not deny) because there
are instances where, under high load, exim might respond on the
correct interface at first.
From the data gathered here there is no direct proof that the spam
hits on the primary have diminished, of course if I had kept one of
the most spam targeted domains as a reference I could say more.
What I can say is that the hits on the secondary are just about 14%
of the total spam (defined as rejections + hits on secondary). Note
that hits on secondary might be inflated because the error returned
is temporary (but I have it now, for a while, a permanent error, to
study some other stuff..).
Also note that a small amount of servers hit the secondary after
having been rejected by the primary.
Since in my case the spam figures are underestimated (because as I
said some low scoring spam is effectively rejected with long delays,
and it cannot be accounted for easily), you see that this device is
not very useful, in particular if you, as I do, already reject over
99% of spam by more conventional methods (and none of these involves
DATA phase scanning). The only positive effect is to reduce the load
on RBLs and the number of callouts.
Giuliano
--
H U M P H
|| |||
software
Java & C++ Server/Client/Human Interface applications on MacOS - MacOS X
http://www.humph.com/
