Slashdot Mirror

← Back to Stories (view on slashdot.org)

Stopping Spammers Who Exploit Secondary MX?

Posted by Cliff on from the closing-the-holes dept.

drteknikal asks: "I'm the admin for a small law firm. We use our ISP as our secondary mx. We are receiving spam from our secondary mx even when our primary has been continually available. We suspect that spammers are routing to our secondary MX to bypass the DNS-based spam filtering on our primary. After examining some of the traffic, our ISP agrees. Neither of us sees an immediate solution, given the purpose and function of secondary MX. They already restrict relaying to hosts on their network. Has anyone else seen this? Does anyone have suggestions on how an ISP could secure their mail exchangers without interfering with the functionality required to function as secondary MX for an external domain?"

1 of 50 comments (clear)

  1. The way I see it... by wonkamaster · · Score: 4, Informative
    The spammers seem to be exploiting a flaw in your methodology. I'm not sure there is a good way around the problem -- at least how you're doing things now.

    The core of your problem is the fact that your ISP is accepting SMTP traffic for you and does not support the same policies as your own mail server supports. If you want to get rid of the SPAM coming from your ISP, you need to be able to implement policies on the secondary MX server.

    I would suggest one of the following:
    • Collocation: Put one of your own servers at your ISP to which you have full control over
    • In-house: Don't use your ISP as a secondary MX, set up a second server at your site instead (this still protects against primary server failure, but not against ISP connectivity problems)
    • Paranoid: Implement the filters on mail coming in from the ISP. Depending on your filtering software, this might be a little more tricky but it will work.
    With regard to the Paranoid option above, it should just be a matter of checking ALL of the Received headers instead of just the last one. Usually spammers can (and do) forge all of the Received headers except for the last one -- which they can't because your server adds it. In the case of mail received by your ISP, the last two Received headers are guaranteed to be valid.

    Checking all of the Received headers against the SPAM database would do the trick.