Web Hosting Talk : Web Hosting Main Forums : Web Hosting : Email spam issues between windows & now linux

[fearmydesign]

Hello everyone, we have 3 or 4 company emails that are getting 300 to 400 spam mails every single day. The funny thing is that we have over 50 email addresses under the same domain, but only 3 or 4 are getting this much spam.

The problem started when we went from Linux to a Windows dedicated server, now after hacing all this spam issues, we switched back to Linux but we stil have the same problem with the spam.

Can anyone please provide suggestions, tips, or things we check or do on the linux server to protect and fight all this spam?

Also, what caused these 3 or 4 addresses to get this much spam all of a sudden?

Regards,
Thank you

[care4server]

did those 3 or 4 mail accounts subscibe to spam or porn sites

[ahdon]

This is a very common issue that spammer using any_user_name@yourdomain.com to send spam

[MikeDVB]

The difference between the first Linux system and the Windows system was likely mail scanning (such as SpamAssassin, or something else). A good portion of the spam emails were likely being filtered and they aren't being filtered now.

Look into your control panel to see if there are settings you can enable to filter spam (some providers default them to off).

[BoswerJ]

I had the same issue and followed MikeDVB's advice. Definitely worked for me. Have you had any luck yet?

[CN-Jeremy]

I addition to setting up SA there are several other tricks you can do to lower your spam.

#1 Setup greylisting, forces the sending mail server to retry after x minutes before accepting the mail.
#2 Use RBL's (in SA) - zen.spamhaus.org
#3 Setup multiple ghost MX records
example:
mx.yourdomain.com priority 0 => fake or pointed to IP with blocked smtp port
mx1.yourdomain.com priority 10 => fake or pointed to IP with blocked smtp port
mx2.yourdomain.com priority 20 => pointed to real email server IP
mx3.yourdomain.com priority 30 => fake or pointed to IP with blocked smtp port
mx4.yourdomain.com priority 40 => fake or pointed to IP with blocked smtp port

Most spammers are drive by spammers and there servers will not retry connections because it slows them down. By putting your real servers mx record in the middle you are making the spammers system have to retry the different mx locations to find the right one.. Also you put some at the end because some spammers have wised up and automatically try the last one as well.

#4 Use SPF records
#5 Only accept mail from IP's that resolve back to the correct DNS name.
#6 Use RBL's that block dynamic IP addresses by ISP's, this will block infected zombie machines from send you spam.

#7 always set reject to "fail" on your server

Using these tricks should decrease your spam by alot. The MX record trick has been one of the most effective ones I have used to date. Added with Spam Assassin using RBL's you should be able to decrease your spam by 90%.

Of course you can use other things like ASSP or Razor as well but so far I have not seen a need to add them to the mix.