Re: How I spent my Christmas vacation - Email found in subject
- From: Danny <nocmonkey@xxxxxxxxx>
- To: "[ISAserver.org Discussion List]" <isalist@xxxxxxxxxxxxx>
- Date: Tue, 3 Jan 2006 23:00:59 -0500
On 1/3/06, Thomas W Shinder <tshinder@xxxxxxxxxxx> wrote:
> Hi Danny,
>
> I think you're mixing me and Dan up. I don't send NDRs.
Let me quote your story:
"The result was very interesting. It showed that two of my inbound
SMTP spam whacking relays (inbound mail goes through four spam
whacking/AV relays before hitting my Exchange Server -- I don't like
putting Antispam/AV software on my Exchange Server because of the
performance hit) were making thousands of requests for MX records. Now
I asked myself the question "why would these relays make thousands of
MX record requests"?
The answer to that question was because the SMTP relays were trying to
resolve the MX domain names of spammers, most of which are bogus.
Since the Christmas season saw a big spike in spam coming into my
network, there was a large spike in the number of MX requests for the
NDRs"
To me, this means that:
1) You have Exchange and IIS SMTP
2) You accept email sent to non-existent recipients
3) Your IIS SMTP servers were trying to send NDRs to spammers forged
sender addresses
4) Or if you do not have NDRs enabled, then A) You do not care to
inform legitimate senders whether or not they sent an email to the
correct address or B) You do care, and therefore a human spends time
reading your SMTP logs looking for legitimate emails accidentally sent
to the wrong address.
My mistake if I misunderstood this.
> Not from any of the relays in my spam relay chain, or from the Exchange
> Server.
So, your SMTP servers accept everything and does not inform the sender
of any recipient errors during the SMTP conversation.
>I see the wisdom in Dan's arguments and why he needs to enable NDRs. I don't
> have the same requirements in my deployments, so I don't send them.
Right.
> So, my scenario, the problem was with the IIS platform and its SMTP
> service and the inablity to turn off NDRs.
OK, so you DO NOT send NDRs, yet with your IIS platform you *cannot*
turn off NDRs. Lets get this straight, you have turned off NDRs on a
platform that you *cannot* turn off NDRs. Cool.
...D
Other related posts:
