Running Two Mail Servers (To Reduce Spam with Greylisting)?

Question

Level 1

88 points

Running Two Mail Servers (To Reduce Spam with Greylisting)?

Heeeeey. So I'm running Snow Leopard Server on my primary server that lives in a data center. I'm running the mail server that comes with OS X Server, and controlled by Server Admin.app.

I've been getting TONS of spam lately. I know that this version of postfix (I think its postfix?) has the option to do greylisting. And when I do greylisting, it works at preventing most and nearly all of my spam. HOWEVER just by virtue of the way greylisting works, it can cause significant slow-downs in legit email, particularly mail from large multi-server providers like GMAIL.

So what I clearly need is to FINALLY put those SPF records to good use, and enable greylisting, but only for incoming email that fails SPF check, or that has no SPF records. Or to put it another way, greylist all mail, but allow a bypass for mail that successfully passes an SPF record check.

Well, I don't think my mail server can do this. Not without a lot of work that some random security update could easily undo (it's not impossible that there could be another update, even on this older OS). So then it got me thinking...

What if I set up a second mailserver running right on the same machine? I could set up the old mailserver to listen on port 26 instead of 25 (in addition to 587), and the new server could listen on 25. It could do the spf/greylisting, and then all mail it accepts, it could just relay to the "real" mailserver. The real mailserver could be configured to whitelist it's own host, so all mail from the greylist server should come in no problem.

Does this sound like a workable plan? Am I missing any logical problems in this process? I guess I would have to *** my realtime blacklists to the new server too, not the 'real' server, for them to work effectively. What do you think?

Xserve, Mac OS X (10.6.8)

Posted on Aug 1, 2015 12:57 AM

Reply

Answer 1

l008com Author

Level 1

88 points

Aug 15, 2015 4:01 AM in response to l008com

Hmm, thought (hoped) this would get SOME level of response :-/ I still haven't had the time to dig into this further, but my spam situation gets worse by the day so I may have to soon.

Reply

Answer 2

UptimeJeff

Level 4

3,479 points

Aug 26, 2015 7:24 PM in response to l008com

There are easier ways to reduce spam.

Gather the facts... In most cases, there are specific issues or patterns when you look at the slipping spam.

What are the x-spam status headers on those messages?

What domains are they from?

Perhaps some tests are failing or triggering when they shouldn't.

Here's a common situation I run into

Look at the from/reply addreses from your spam? I've seen some servers where 70+ percent of the spam is from non-original TLDs.

.info .xyz .mobi, etc

A spamassassin filter that raises the score for those addresses is VERY effective and if setup right can also push the messages to a high enough score where spamassassin learns from them. When spamassassin learns the traits, it becomes more effective.

For those cases, a simple spamassassin filter can increase the score on those TLDs causing them to be filtered.

There are plenty of spamassassin, amavis and postfic settings you should consider.

To analyze the spamassassin tests and spot patterns, I use a script which pulls those headers from all missed spam... the aggregate data makes it easy to spot patterns.

Take the time to analyze the missed spam.

Reply