[exim] Wild Idea for spam filtering

Top Page
Delete this message
Reply to this message
Author: Marc Perkel
Date:  
To: exim-users
Subject: [exim] Wild Idea for spam filtering
I've been testing my latest trick in spam filtering with good success.
It's even qmail compatible.

What I'm doing is that I have at the moment 4 MX records. The lowest and
highest are dead IP addresses. Normal mail servers will hit the lowest
MX, fail, and then succeed on the next higher MX.

The idea is that I'm screening on the ability of the server to try
multiple MX records. It's very crude, very effective, and very simple.
It basically gets rid of the spam zombies.

However - thinking about making it a little more complex. All normal
servers should attempt the lowest MX first. So suppose that on the
lowest MX I had something that recorded the IP address of hosts that
attempt the lowest MX. This attempt is stored for say 2 hours. Then when
they retry the higher MX records the system knows that they have already
attempted the lower one and it is not rejected. But hosts that try the
higher MX records without having tried the lower one first are deferred.

If you like the idea of forcing hosts to try the lowest first by accept
on the secondary I have some idea of how to implement it. The lower MX
attempt need to be stored in a MySQL database and then you run MyDNS on
it to create a DNS whitelist which is used by the higher MX servers to
determine if the message is deferred or not. I'm still thinking about
the details but I think this trick would be faster than greylisting and
more accurare. I think it could eliminate 100% of zombie spam.

Thoughts?