Showing posts with label Fake lowest and highest MX records to reduce zombie spam. Show all posts
Showing posts with label Fake lowest and highest MX records to reduce zombie spam. Show all posts

2008/08/21

Fake lowest and highest MX record to reduce zombie spam

I have been using the method of fake lowest MX record to reduce zombie-originated spam. An example is illustrated as follows :

1H IN MX 10 fake.mymail.com
1H IN MX 20 realmx.mymail.com

The fake record of MX=10 can either be undefined or can point to a dead IP address.

Legitimate sending email servers will get the error and retry the MX=20 and deliver the email successfully with some delay. Zombie spam will not try MX=20 and just move on to the next victim.

The above has a shortcoming that zombie might try deliver to the IP address read from the highest MX record (usually backup server) on the assumption that the backup mail server has less anti-spam features. A more careful setting is :

1H IN MX 10 fake.mymail.com
1H IN MX 20 realmx.mymail.com
1H IN MX 30 fake.mymail.com

Some have reported that the fake lowest MX and highest MX records working together can reduce 90 % of zombie spam.

More information on this method is in http://wiki.apache.org/spamassassin/OtherTricks