Author: David Woodhouse Date: To: Roger Burton West CC: exim-users Subject: Re: [exim] Telling a secondary MX about valid addresses on the
primary
On Sat, 2011-02-26 at 09:57 +0000, Roger Burton West wrote: > I have two MX machines, call them mx0 and mx1; mx0 is the lower-priority
> and does deliveries to users. As is the way of the world, mx1 gets hit
> by a lot of spammers with scraped addresses which will be undeliverable
> (e.g. message-IDs). At the moment, mx1 accepts the message (assuming it
> passes the spam filter), and forwards it to mx0, which rejects it; then
> mx1 tries to send a bounce message to the (faked) originator.
My solution for this is to use recipient verification on the secondary
MX. In the common case where the primary is actually up and running,
such recipients get rejected immediately.
I set 'defer_ok' on the verification, so that in the rare cases where
the primary is actually down, the mail does get accepted anyway (and
thus, there is the occasional small chance of still bouncing mail).
To further reduce that chance, the "main" domains used for email are now
virtual domains with aliases stored in DNS TXT records (since I was
looking for a distributed database to use between all the machines in
the cluster, and then realised I already had one). So in fact for the
@infradead.org domain and various others, *all* the listed MX hosts have
a full list of recipients (which generally just forward to a specific
machine in the cluster).
