Hi,

I am not sure if this question came along already, but I have the following problem.

Because I am a small user I can’t afford a fallback mail server myself, instead I use a mail server from somebody else. The problem I noticed is that a lot of spam send to a backup mail server, the highest rank number, these came therefore from a mail server that is not in the MAPS list and it will not recognized as spam. The mail only will be stopped when I manually put the IP,s, from the original sender, in the blacklist or when they are recognized by the SURBL or any other body filter.

It will also happen when people have a mail address, not from my domain,  and have them all forwarded to my domain.

Can I do something about this behavior?

jemmie

• Use your keywords blacklist, with ScanReceivedHeaders set to "1" so that you can blacklist major-offending i.p.s that appear somewhere in the stack of spam received headers from those messages (sounds like you're already doing this)
• Add bogus MX records to your DNS - with a lower precedence level (like 90) then any of your legitimate mail servers.  Some spammers will attack only your lowest-precedent mail server -  assuming that it may have the lowest level of filtering protection - and then give up.  Some spammers follow the RFC guidelines and actually attempt your mail servers in proper order.  And some just try 'em all .  In any case, it seems to have reduced some of the spam otherwise coming from my backup; but it's not a full & perfect solution - you will still get plenty of spam.
  

• So you don't have the resources to shell out thousands of dollars for the sole purpose of a backup mail server; maybe a standard machine at home might help (then again, as mentioned before, some spammers prefer the backups - increasing the load on those machines that are intended to rarely be active).
• Obviously, if this home machine has identical rules as your primary mail server, any message that passes one would have passed the other; therefore, you can whitelist your home address's i.p. as it forwards mail to your primary.
  
• You'd have to figure out what to do with your quarantine.  You probably would not be excited to have you or your users sifting through two web interfaces instead of one.  Perhaps if you allow your existing database to be accessed over the internet, you can have your backup mail server connect and upload data to your database, hopefully without exposing a security hole.
  

Thanks for your response and clarification of things.

It's not that I don't want to spend money on a fallback server, but my main server is already at my home and because I am not a company and use a simple broadband connection, my ISP won’t give me a second IP number, then there is still the problem when my connection fails.

You're right I use the blacklist to filter the header for known IP’s, that works a little but it’s cost a lot of time to keep track of all the IP numbers and type them manually in the blacklist, but I guess there is no other way.

I already use several MX records, a friend give me this option.  I use three record, first my mailserver second my fallback and third my mail server again, but I should try a bogus one as highest rank.

I guess the conclusion is, I have to live with it.

jemmie

Stephen,

"As an aside, does anyone have experience with having two SpamFilter installations connect to a central database?  If so, does it work like a peach?  What database do you use?"

I have several servers connecting to a single MS-SQL server with ZERO issues.