Re: mail flow architecture

2 msg	Remote backup Postfix server
7 msg	chose interface for outgoing mail
2 msg	Illegal address syntax ... in MAIL command: <...
1 msg	Mail Infrastructure and Zertificon
1 msg	sasl password
6 msg	postfix TLS (configuration/user) problem
7 msg	Virtual Alias Domain
3 msg	copy of email
2 msg	DNS Caching?
5 msg	Using mysql for mynetworks
5 msg	Blocking e-mail from a domain, to a particular ...
5 msg	prevent open relay
15 msg	cannot get mail from outside to my smtp server
6 msg	Error connecting Postfix to LDAP
5 msg	Config ok for TLS/SASL/Client Cert via port 587?

mail flow architecture
\ Barbara M. (12 Mar 2008)
. \ Ralf Hildebrandt (12 Mar 2008)
. . \ Barbara M. (12 Mar 2008)
. . . \ Ralf Hildebrandt (12 Mar 2008)
. . . . \ Brian Evans (12 Mar 2008)
. . . \ Jorey Bump (12 Mar 2008)
. \ mouss (12 Mar 2008)

3 msg	virtual forward + deliver
1 msg	Re: RESOLVED: Using Canonical Maps as an Overri...
14 msg	dual mail server
3 msg	how to specify different outgoing IP

Subject:	Re: mail flow architecture
Group:	Postfix-users
From:	Jorey Bump
Date:	12 Mar 2008

Barbara M. wrote, at 03/12/2008 03:04 PM:

> As I say, Our FIRTS need is:
> - some hints for using RBL "safely" (NO great chances of experiments in
> production box). Or any other way to limit the incoming mail traffic,
> but simple to implement because the server is old and busy ...

Consider Nolisting:

http://nolisting.org/

The page is detailed because it must be set up precisely, but the
concept is simple: Designate a single primary MX that is never
available. Designate your real MX host(s) at the next priority. This
will immediately block as much as half (or even more) of the zombie spam
aimed at your machine, without consuming any additional resources.
Legitimate mailers will retry delivery immediately, unlike traditional
greylisting, so there is little penalty. You don't have to configure
anything on your MTA, just set a DNS record and preferably use a
firewall to quickly reject with a TCP RESET on the blocked primary MX
IP. If you don't like the results, you can easily restore your previous
setup. However, you might find some instant relief if your server is
truly taxed.

If you're feeling adventurous, you can add Selective Unlisting to target
specific problematic networks, requiring them to try your MX hosts in order:

http://unlisting.org/selective.html

Don't apply Unlisting to all connections, or you will have problems with
some big ESPs like Gmail. It's handy to use selectively for networks
that aren't a critical source of mail.