[Top] [All Lists]

Re: [Asrg] host named "mail" that is not an MX

2005-06-02 17:37:21
Hash: SHA1

Markus Stumpf writes:
On Thu, Jun 02, 2005 at 12:42:35PM -0700, william(at) wrote:
First I heard of it, but it would sure explain some things as to why I
still receive on my mail server messages for old domains no longer there
that we're not even relaying for. I never kept any statistics though and 
don't think its significant (but maybe its just because those domains have 
always had less mail than active ones).

I've seen this on some of our central mailservers, too. IMHO this is
because of stale DNS entries in broken DNS caching software. But I have
always wondered why e.g. is spammed with mails for even if it is not in the MX list. This is not because of stale
DNS entries (the MX has never been there).
IMHO spammers think that if a exists and accepts mails
(aka port 25 is connected) but is not the MX it may be a "shielded" weak
server and the official best MX runs antispam and antivirus software but the
hidden mailserver is an easy victim.

aha, that's it, you're right.  This is the Postini recommended
configuration, from what I've heard, so that probably explains it.
(handy to know, if you're running into Postini FP'ing on your mail ;)

: jm 358...; dig mx

; <<>> DiG 9.2.4 <<>> mx
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 50691
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 4, AUTHORITY: 4, ADDITIONAL: 4

;                 IN      MX

;; ANSWER SECTION:          86400   IN      MX      300          86400   IN      MX      400          86400   IN      MX      100          86400   IN      MX      200

;; AUTHORITY SECTION:          40465   IN      NS          40465   IN      NS          40465   IN      NS          40465   IN      NS

;; ADDITIONAL SECTION:      20056   IN      A 98495 IN   A      32907   IN      A      32907   IN      A

;; Query time: 31 msec
;; WHEN: Thu Jun  2 17:34:44 2005
;; MSG SIZE  rcvd: 346

: exit=0 Thu Jun  2 17:34:44 PDT 2005; cd /home/jm/ftp/spamassassin/t
: jm 359...; telnet 25
Connected to
Escape character is '^]'.
220 ESMTP Postfix (Debian/GNU)
telnet> q
Connection closed.

- --j.
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Exmh CVS


Asrg mailing list