Re: Strange problem?

On Wed, 19 Jan 2005 22:26:36 -0500, Ken Lowther <[email protected]> wrote:
> My queue started filling up mail well past the expire time.  What looks like is
> happening is that a spammer tried to send to or relay through me and then
> killed the domain. I suppose the domain could have been forged, but I do
> reverses.  I had bounces set up for about 6 hours figuring that most legitimate
> bounces would be delivered in that time.
> 
> I ran exim -qff -v and watched.  I was getting some very long timeouts.  I set
> bounces to die after 0h and I am down from around 3700 to around 2500 after
> about 8 hours. That includes me killing some of the older stuff manually.
> 
> I originally though I had caused the problem by changing the timeouts when I
> first noticed the queue seemed to be growing.  Since this machine, at least
> right now, is primarily a gateway, if something doesn't deliver right away,
> then something else is wrong.
> 
> This sound plausible?

Yes. But a well-configured system which rejects unwanted mail at SMTP
time (which is why you have Exiscan) would not suffer from that
problem.

You need to make sure you're taking all the decisions about whether a
mail is deliverable or not before you accept it- which means scanning
(virus and/or spam), DNSBLing, HELO checks, sender verification, and
probably most importantly in the case of a gateway machine, recipient
verification.

Peter