Re: [exim] How to handle DNS timeout delays when spam RBL is…

Top Page
Delete this message
Reply to this message
Author: Mar Matthias Darin
Date:  
To: exim-users
Subject: Re: [exim] How to handle DNS timeout delays when spam RBL is under DDoS attack?
Hello,

Alexander Perlis writes:

> But sometimes the upstream spam RBLs we rely on seem to "disappear",
> probably suffering a DDoS attack. In those cases, Exim4 message
> processing grinds to a crawl, taking over 30 seconds per message. What's
> happening is that the DNS lookups for the disappeared RBL are timing out...


Increasing the size of your local cache will give you a big advantage.
Also, in your /etc/resolv.conf, try having the following:

search localhost
nameserver 127.0.0.1

if the name server is on the same server as exim, otherwise modify the
resolv.conf to contain only the local name server(s). The effect will be a
higher load on your local name server(s), but less impact on exim for
multiple requests. The larger the DNS cache, the breeter your performance
will be, though YMMV.

Also, a TTL in your name server of at least 86400 may boost performance.
You don't want to go more then 48 hours though or you'll start running into
cache bloat.

Hope this helps.

---

DynaStop: Stopping spam one dynamic IP address at a time.
http://tanaya.net/DynaStop/