Re: Dummy backup MX

[David Gibbs <david@xxxxxxxxxxxx>]

John Ross wrote:
> I am with Scott. I thought in this case always meant always the first
>  time (like Greylisting http://en.wikipedia.org/wiki/Greylisting).
> But every site I went to just said always for that software. Which to
> me means 1st, 2nd, 3rd, etc. So if it really is always I am at a lose
> for a real business use for this, that might not interfere with valid
> email.

A favorite technique of spammers is to connect to the lowest priority
MXs for a domain (those with the largest numerical value) in an attempt
to avoid any anti-spam filters that may be running on the primary
(highest priority) MX. (http://en.wikipedia.org/wiki/MX_record#MX_priority).

> How do you know if you get legit emails, does it have a log file?

It does log to the standard syslog mail facility, so I do know what's
hitting the system ... and, as far as I can tell, 99% of the delivery
attempts to the bogus backup MX have been spam.  Any real mail delivery
will be retried to the main server.

Keep in mind ... the bogus backup MX doesn't indicate there is an error
with delivery ... just that the server is too busy to handle the
connection.  Any normal mail server will attempt a retry ... so no mail
will be lost.

Basically, I'm giving the spammers a target to bang their heads against
(so to speak) that doesn't effect my system.

david