LogSat Software

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic

   I use a service that will become my backup email server should mine go off-line.  It will hold the email and then forward it onto mine when mine is back on-line.  The problem is that spamfilter sees this backup email server as the host IP for the email and it will pass everytime because it is not on a blacklist.  (lets hope it never is also).  Anyway, the other hole this creates it that spammers could intentionally go to my secondary MX records and email directly to it knowing it will validate the IP.  Thoughts?
Here is an example:  Spamfilter should have processed against 66.165.236.247 not my backup email server 63.219.###.###

08/17/04 13:04:38:015 -- (1508) Resolving 63.219.###.### - mx1.#####.com
08/17/04 13:04:38:156 -- (1508) - SPF analysis done: - none
08/17/04 13:04:38:156 -- (1508) Mail from: b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com
08/17/04 13:04:43:406 -- (1508) - MAPS search done... 
08/17/04 13:04:43:406 -- (1508) RCPT TO: ###@#####.com accepted
08/17/04 13:04:43:718 -- (1508) EMail from b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com to ###@#####.com was queued. Size: 3 KB, 3072 bytes
08/17/04 13:04:43:734 -- (700) Sending email from satellite@consumer-value1.com to ###@#####.com08/17/04 13:04:43:812 -- (1508) Disconnect
08/17/04 13:04:44:609 -- (700) EMail from satellite@consumer-value1.com to ###@#####.com was forwarded to cm1.#####.com:25

Return-Path: <b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com>
Delivered-To: Return-Path: <b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com>
Delivered-To: ###@#####.com 
Received: (qmail 4329 invoked by uid 507); 17 Aug 2004 14:00:10 -0400
Received: from mydomain.com (HELO dell2350) (69.27.###.###)
  by ###.com with SMTP; 17 Aug 2004 14:00:10 -0400
Received: from 63.219.###.### by  (LogSat Software SMTP Server) Tue, 17 Aug 2004 13:04:43 -0500
Received: (qmail 27359 invoked from network); 17 Aug 2004 15:25:12 -0000
Received: from jjy1.vintage-bargains.com (66.165.236.247)
  by mx1.###.com with SMTP; 17 Aug 2004 15:25:12 -0000
Message-Id: <830U35906FD7O367I9GMLWP0N@OEV003ZLU94HZWE5Z20U092Q5>
From: Satellite Television USA <satellite@consumer-value1.com>
To: ###@#####.com
Reply-to:<satellite@consumer-value1.com>
Subject: DIRECTV, Tivo + DVD player - no charge
Date: Tue, 17 Aug 2004 10:18:17 -0400
Complain-To: abuse-qwskbcfacahb-jiajjeb-18thstory@msg.consumer-value1.com
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Content-Type: text/html; charset = "iso-8859-1"
X-Server: LogSat Software SMTP Server
X-SF-RX-Return-Path: b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com

Author	Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic
kelsky Members Profile Send Private Message Find Members Posts Add to Buddy List Guest Group	Post Options Post Reply Quote kelsky Thanks(0) Quote Reply Topic: Backup Email Servers Posted: 17 August 2004 at 2:30pm
	I use a service that will become my backup email server should mine go off-line. It will hold the email and then forward it onto mine when mine is back on-line. The problem is that spamfilter sees this backup email server as the host IP for the email and it will pass everytime because it is not on a blacklist. (lets hope it never is also). Anyway, the other hole this creates it that spammers could intentionally go to my secondary MX records and email directly to it knowing it will validate the IP. Thoughts? Here is an example: Spamfilter should have processed against 66.165.236.247 not my backup email server 63.219.###.### 08/17/04 13:04:38:015 -- (1508) Resolving 63.219.###.### - mx1.#####.com 08/17/04 13:04:38:156 -- (1508) - SPF analysis done: - none 08/17/04 13:04:38:156 -- (1508) Mail from: b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com 08/17/04 13:04:43:406 -- (1508) - MAPS search done... 08/17/04 13:04:43:406 -- (1508) RCPT TO: ###@#####.com accepted 08/17/04 13:04:43:718 -- (1508) EMail from b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com to ###@#####.com was queued. Size: 3 KB, 3072 bytes 08/17/04 13:04:43:734 -- (700) Sending email from satellite@consumer-value1.com to ###@#####.com08/17/04 13:04:43:812 -- (1508) Disconnect 08/17/04 13:04:44:609 -- (700) EMail from satellite@consumer-value1.com to ###@#####.com was forwarded to cm1.#####.com:25 Return-Path: <b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com> Delivered-To: Return-Path: <b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com> Delivered-To: ###@#####.com Received: (qmail 4329 invoked by uid 507); 17 Aug 2004 14:00:10 -0400 Received: from mydomain.com (HELO dell2350) (69.27.###.###) by ###.com with SMTP; 17 Aug 2004 14:00:10 -0400 Received: from 63.219.###.### by (LogSat Software SMTP Server) Tue, 17 Aug 2004 13:04:43 -0500 Received: (qmail 27359 invoked from network); 17 Aug 2004 15:25:12 -0000 Received: from jjy1.vintage-bargains.com (66.165.236.247) by mx1.###.com with SMTP; 17 Aug 2004 15:25:12 -0000 Message-Id: <830U35906FD7O367I9GMLWP0N@OEV003ZLU94HZWE5Z20U092Q5> From: Satellite Television USA <satellite@consumer-value1.com> To: ###@#####.com Reply-to:<satellite@consumer-value1.com> Subject: DIRECTV, Tivo + DVD player - no charge Date: Tue, 17 Aug 2004 10:18:17 -0400 Complain-To: abuse-qwskbcfacahb-jiajjeb-18thstory@msg.consumer-value1.com MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/html; charset = "iso-8859-1" X-Server: LogSat Software SMTP Server X-SF-RX-Return-Path: b-0Ywxbcfacahb-jiajjeb-@msg.vintage-bargains.com

LogSat Members Profile Send Private Message Find Members Posts Add to Buddy List Admin Group Joined: 25 January 2005 Location: United States Status: Offline Points: 4105	Post Options Post Reply Quote LogSat Report Post Thanks(0) Quote Reply Posted: 17 August 2004 at 11:26pm
	Kelsky, Spammers are known to send spam email to all servers for which an MX record exists. If you have a secondary MX record for your domain(s), it will receive spam. Your backup "service" should run an anti-spam application on their end so they can give you clean email. When the backup server forwards you the email, as you've seen, SpamFilter will "see" the IP address of that backup server, not the original IP of the sender, so all of SpamFilter's IP-based filter will not work, and you will be left with the keyword and Bayesian filters only. There is not really a workaround for this, as normally users own both primary and secondary MX servers, and install SpamFilter as a gateway for both of them. Roberto F. LogSat Software

kspare Members Profile Send Private Message Find Members Posts Add to Buddy List Senior Member Joined: 26 January 2005 Location: Canada Status: Offline Points: 334	Post Options Post Reply Quote kspare Report Post Thanks(0) Quote Reply Posted: 18 August 2004 at 10:25am
	Kelsky, fire me an email, I can probably help you out with your situation. You can get me @ kpare@ksphosting.com Kevin

LogSat Software

Site Navigation[Skip]

Spam Filter ISP Support Forum

Backup Email Servers