Dealing with incomming junk mail

mishmash · 27-08-2008, 02:41:40 AM

I have a domain which is receiving lots of junk mail; perhaps "backscatter" from some spamming. I thought I'd share my experience dealing with it.

This was seriously hammering my server:

Code:

top - 02:09:37 up 60 days, 10:11,  1 user,  load average: 22.36, 85.27, 83.81
Tasks: 197 total,   2 running, 195 sleeping,   0 stopped,   0 zombie
Cpu(s):  7.0% us,  1.3% sy,  0.0% ni,  0.0% id, 91.0% wa,  0.7% hi,  0.0% si
Mem:    506736k total,   482052k used,    24684k free,     7100k buffers
Swap:  1015800k total,   981944k used,    33856k free,    32044k cached

One solution which helped was to change the default address from
:blackhole to :fail

This did massively reduce the server load. However it means I'm now backscattering junk myself from this domain.

One question is - is there anyway I can get the effect of :blackhole with the server load of :fail

I watched the junk via:
tail -f /var/log/exim_mainlog

Something else which might help others - my server was so overwhelmed I could not get to WHM/Cpanel

so via ssh I ran:
perl -pi -e "s/:blackhole:/:fail:/g;" /etc/valiases/thedomainname.co.uk

then restarted

This gave me most of my functionality back...

Another question - why did it take some time for some domains to work? accessing sites via IPs worked straight away, but even though BIND was up and working again accessing by domain didn't - it took a few minutes - as if something was propagating? Perhaps some DNS cache somewhere on my ISP maybe???

I then changed the MX record on the domain to mail.example.com (this hasn't had much effect) yet, the site runs a forum so I'll have to turn it back at somepoint but I thought this might help get rid of this evening's problem?

Any comments / suggestions?

monaghan · 27-08-2008, 08:19:03 AM

If this is your own box, try ASSP, this dropped my load significiantly on shared hosting boxes. There's a couple of threads over at the cpanel.net forums with further details and if you look at ASSPX it's a free implementation direct into cPanel.

blacknight · 31-08-2008, 03:54:17 PM

If you have root access to the server, which you seem to have, I'd recommend setting up exim to drop connections from any host that is listed in spamhaus. We're dropping several million emails a day using this and it makes life a lot easier

27-08-2008, 02:41:40 AM	#1 (permalink)
mishmash Join Date: Jan 2005 Posts: 160 No Classified Ratings Domain Trader Rating: (0% / 0)	Dealing with incomming junk mail I have a domain which is receiving lots of junk mail; perhaps "backscatter" from some spamming. I thought I'd share my experience dealing with it. This was seriously hammering my server: Code: top - 02:09:37 up 60 days, 10:11, 1 user, load average: 22.36, 85.27, 83.81 Tasks: 197 total, 2 running, 195 sleeping, 0 stopped, 0 zombie Cpu(s): 7.0% us, 1.3% sy, 0.0% ni, 0.0% id, 91.0% wa, 0.7% hi, 0.0% si Mem: 506736k total, 482052k used, 24684k free, 7100k buffers Swap: 1015800k total, 981944k used, 33856k free, 32044k cached One solution which helped was to change the default address from :blackhole to :fail This did massively reduce the server load. However it means I'm now backscattering junk myself from this domain. One question is - is there anyway I can get the effect of :blackhole with the server load of :fail I watched the junk via: tail -f /var/log/exim_mainlog Something else which might help others - my server was so overwhelmed I could not get to WHM/Cpanel so via ssh I ran: perl -pi -e "s/:blackhole:/:fail:/g;" /etc/valiases/thedomainname.co.uk then restarted This gave me most of my functionality back... Another question - why did it take some time for some domains to work? accessing sites via IPs worked straight away, but even though BIND was up and working again accessing by domain didn't - it took a few minutes - as if something was propagating? Perhaps some DNS cache somewhere on my ISP maybe??? I then changed the MX record on the domain to mail.example.com (this hasn't had much effect) yet, the site runs a forum so I'll have to turn it back at somepoint but I thought this might help get rid of this evening's problem? Any comments / suggestions?

27-08-2008, 08:19:03 AM	#2 (permalink)
monaghan Join Date: May 2007 Posts: 1,052 No Classified Ratings Domain Trader Rating: (100% / 7)	If this is your own box, try ASSP, this dropped my load significiantly on shared hosting boxes. There's a couple of threads over at the cpanel.net forums with further details and if you look at ASSPX it's a free implementation direct into cPanel. __________________ Alex Monaghan - Drop Catch & Drop Lists - PM for details Online Accounting\|Pine Furniture\|Barbie

31-08-2008, 03:54:17 PM	#3 (permalink)
blacknight Join Date: Apr 2007 Location: Ireland Posts: 118 No Classified Ratings Domain Trader Rating: (100% / 4)	If you have root access to the server, which you seem to have, I'd recommend setting up exim to drop connections from any host that is listed in spamhaus. We're dropping several million emails a day using this and it makes life a lot easier __________________ Blog \| Domain Blog \| Hosting & Domains

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode