Exim and backup relays

[Ian Spray]

On Thu, Jun 11, 2009 at 02:30:52PM +0100, Longman wrote:
> * Ian Spray wrote:
> > Yup - this is a common problem.  One very quick fix (which works for all 
> > systems and not just exim) is a bogus last MX record.  The spammers do 
> > tend to start at the lowest numbered MX and work up, so this cuts things 
> > down a little, but isn't a full solution:
> 
> Highest numbered ?  i.e. Lowest priority.
> 
<blush>  Ahem.  Yes: you're correct, and I was thinking faster than I 
was typing...

They start with the lowest priority (in general) as there's normally 
less checking there.  Quite what metric of success they have to say that 
it was delivered when it sat in a queue for 14 days and then got thrown 
away I don't know.  Maybe they get paid by number of non-bounce sends 
per spam run ?  Heh - Spammers have Managers ;)

> > The other, exim specific thing is to get your backup MX to test during 
> (snip userful comments about exim).
> 
> There is also receiver_verify, ignore_errmsg_errors,
> ignore_errmsg_errors_after, and timeout_frozen_after to look at.  I use
> CHECK_RCPT_VERIFY_SENDER = 'true' but doesn't seem to do much.  Will try
> out some of your suggestions, thanks :-)
>
Oh you're welcome to those too !  I've discovered from experience that 
frozen messages (caused by an attempt at delivery that was actively 
refused) are 99.9% junk, so have a very low tolerance for that on my 
server.  Technically it could be a server mis-configuration and some 
email could be lost if the problems are then fixed, but I'm only running 
this for myself and have not had any problems so far.

timeout_frozen_after = 2d
ignore_bounce_errors_after = 1d

I would say that the verify_sender option worked wonders a couple years 
of ago but that it's use is now of limited success: it appears that 
spambot syntax is improving.  I've certainly not refused valid email 
through the use of it, so in my book that means leave it enabled !

I also have two sets of retry counters: one for a domain I am being 
backup MX for, and one for everything else.  Note that I try much more 
agressively to redelivery email to the backup MX (every 15m for 24h) so 
that small outages/reconfigures don't hold up their email too much.

begin retry
 abackupmx.com    *           F,24h,15m; F,7d,2h; F,14d,6h
 *                *           F,2h,15m; G,16h,1h,1.5; F,14d,6h

I also have a couple of other countermeasures that I've not seen 
publicly discussed, so have refrained from doing so myself as they're 
rather effective and I don't want them to stop working from having my 
config end up in Google.  I'll email those to you privately, and will 
happily share those ideas with another list members who want them (they 
are exim specific in implementation, but not concept).  Possibly overly 
paranoid to think that spambot writers read my postings, but then again 
I currently reject far more junk than I accept and want to keep it like 
that !

HTH,
-- 
Ian Spray
GPG Fingerprint: D170 35A3 C858 6E85 9B5B  1557 4CD5 6F6F E176 2D0A