[plug] Blacklisted mail server?

[Adrian Woodley]

A further, scarier stat; after quick calculation (again, from 1 out of 8 mail filter servers), 34% of email sent from our customers is spam or virus (and is dropped by our filters). Hasn't Windows been great for the Internet!

Adrian

On Fri, 5 May 2006 20:53:05 +0800, Adrian Woodley <Adrian at ScreamingRoot.org> wrote:
> 
> These stats are from 1 of our 8 mail filter servers for the past hour:
> 
> ====================================================
> Incoming Mail Category  	%  	# Messages
> Total Attempted Messages 	318283
> 
> 	 Stopped by Reputation Filtering
> 	77.46 	246544
> 
> 	 Invalid Recipients
> 	9.49 	30220
> 
> 	 Spam Messages Detected
> 	7.88 	25093
> 
> 	 Virus Messages Detected
> 	0.08 	240
> Total Threat Messages 	94.91 	302097
> 
> 	 Clean Messages Accepted
> 	5.09 	16186
> ====================================================
> 
> Nearly 95% of email delivered to us is spam. You don't want to see the
> stats for the whole day...
> 
> Adrian
> 
> On Fri, 05 May 2006 19:29:59 +0800, Ben Jensz <plug at jensz.id.au> wrote:
>> To quote Wietse - "Junk mail is war, RFC's do not apply".
>>
>> It can be useful to drop known "bad" client IPs before they get to the
>> actual SMTP service, as then it uses less resources on your mail server
>> systems as you don't have the overhead of having used up one available
>> SMTP connection to a host that you're only going to tell to sod off
>> anyway.  Considerations such as this do come into play when you're
>> dealing with large volumes of email like ISP's do.
>>
>> That said, there have been issues with the Sorb's DUL list during the
>> last week, which have lead to ranges being incorrectly listed.  So
>> actively giving a reject response (rather than just dropping the
>> connection outright) does at least give the sending client an indication
>> as to what is wrong.
>>
>>
>> / Ben
>>
>>
>> Mike Holland wrote:
>>>
>>> Isn't that just plain wrong?  Both with internet protocol standards,
>>> and ethics.
>>>   They should give an error message with explanation first. e.g.
>>> postfix says:
>>>
>>> 554 Service unavailable; Client host [xxx.xxx] blocked using
>>> >     dul.dnsbl.sorbs.net; Dynamic IP Addresses See:
>>> >     http://www.sorbs.net/lookup.shtml?[xxx.xxx]
>>>
>>> So at least the poor guys know whats happening.
>>>
>>
>> _______________________________________________
>> PLUG discussion list: plug at plug.org.au
>> http://www.plug.org.au/mailman/listinfo/plug
>> Committee e-mail: committee at plug.linux.org.au
> --
> Adrian Woodley
> 
> ~#
> ScreamingRoot.org
> Technical resource for *nix admins.
> Are you a Screamer?
> 
> _______________________________________________
> PLUG discussion list: plug at plug.org.au
> http://www.plug.org.au/mailman/listinfo/plug
> Committee e-mail: committee at plug.linux.org.au
-- 
Adrian Woodley

~#
ScreamingRoot.org
Technical resource for *nix admins.
Are you a Screamer?