Re: [bitfolk] Spam overwhelming my mail server

I use a managed email filtering service (Symantec.cloud - formerly MessageLabs) which obviates the need for checking quite so much. My exim server only accepts SMTP connections from designated IP addresses and runs spamassassin to pick up some of the false negatives that they let through but all of the RBL stuff is done upstream. It works very well. Andrew <div>-------- Original message --------</div><div>From: Keith Williams &lt;keithwilliamsnp(a)gmail.com&gt; </div><div>Date:17/02/2014 07:46 (GMT+00:00) </div><div>To: BitFolk Users &lt;users(a)lists.bitfolk.com&gt; </div><div>Subject: Re: [bitfolk] Spam overwhelming my mail server </div><div> </div>I use SpamCop and SpamHaus RBLs I am using Postfix so am not 100% about Exim, but I use a range of checks and reject mail from non existent domains and unauthorised pipelining. Possibly more but sitting here eating breakfast I can't remember LOL. As for fail2ban look here http://www.zaphinath.com/custom-filter-for-exim-through-fail2ban/   On 17 February 2014 00:05, Gavin Westwood &lt;bitfolk-lists(a)gavinwestwood.me.uk&gt; wrote: Thanks everyone for your suggestions. As at 23:15 it's reached 24,648 rejected spam emails. On 16/02/2014 15:28, Andy Bennett wrote: Unfortunately this wouldn't be satisfactory for my clients and, as this is the second time in 3 weeks that it's been hit by this level of inbound spam (it's not relay attempts - my server gives that short shrift), doing that once a month would be both a pain and cause me to get phone calls.  As long as my clients get their messages in a reasonably timely manner they are generally happy (mail does appear to be getting through despite my home mail server's issues connecting). On 16/02/2014 20:52, ed wrote: Currently I only use RBLs as part of the Spamassassin checks and scoring.  I'm worried about applying stricter RBL checks due to various issues such as the lag or difficulty in removing entries and the poor configuration of some of my clients' regular contact's mail systems and lack of understanding on both sides when mail is rejected. (Thanks to Ian for your reply on this too) I will have a look at greylisting, but I recall from when lug.org.uk implemented it that there was significant impact and delay with emails coming through and again this will lead to issues with clients calling me about emails that they were expecting. On 16/02/2014 21:53, Keith Williams wrote: Ed, Keith (and anyone else) - what RBLs do you consider "good" (taking into account my previously mentioned concerns)? I've got several checks, but am always open to additional suggestions. I have Fail2ban installed, but I don't have it checking Exim logs.  I've not found a config to do that (my regex foo is not strong), but I do block IPs that are regular offenders within my IPTables , however as you note, spammers use many different compromised IPs so that is of limited value.  I've blocked one or two ranges (e.g. Proxad's IPs), but again as my initial point, banning whole IP ranges could impact on some of my clients getting legitimate emails. An interesting thing I have just found from analysing todays logs is that almost all are being sent to email addresses (mostly rubbish names, e.g. message IDs) at a single client's domain name.  Is there a quick way in Exim to apply additional rules just to one domain (such as greylisting or strict application of RBLs)? Thanks Gavin _______________________________________________ users mailing list users(a)lists.bitfolk.com https://lists.bitfolk.com/mailman/listinfo/users -- Keith Williams   Keith's Place  www.keiths-place.co.uk   Tailor Made English   www.tmenglish.org   West Norfolk RSPCA www.westnorfolkrspca.org.uk       ______________________________________________________________________ This email has been scanned by the Symantec Email Security.cloud service. For more information please visit http://www.symanteccloud.com ______________________________________________________________________