Post by Bikini BrowserHello...
I need to figure out how to stop most of the SPAM we are getting using
Microsoft Exchange 2003 running on an SBS Server.
I can't spend any money so I have to do it using the Exchange software.
Someone suggested that I enforce Reverse DNS Lookup rules.
If that is how you do it, how do you do it? How do you enforce Reverse DNS
Lookup rules?
This would seem to be an area that Exchange 2003 doesn't do, but which
would certainly take out a lot of spam. Tarpitting will help somewhat.
Use of a good RBL will stop quite a lot, and IMF will have some effect
on what's left, though a lot of spammers' effort goes into passing
content-based checkers like IMF and SpamAssassin.
Nearly all spam comes from infected home computers. Almost all either
have no reverse DNS, or reverse DNS which doesn't point to a
complementary A record, or whose reverse DNS lookups ('generic') contain
disguised IP addresses or strings like 'dhcp' and 'pool', which are easy
to spot. I also look for reverse DNS or HELO strings which resolve to a
number of two-letter country TLDs. You'd be surprised how much spam you
can reject by looking for your own IP address in the HELO. No imagination...
I get typically 2000 connections a day to my mail server (not Exchange),
of which about 100 are genuine and about three of the rest currently
make it through to my mailbox. That's without either content filtering
or RBL, that's just using the HELO, DNS lookups and tarpitting. I ask
for an ident reply, but I don't reject servers (mostly Exchange!) which
don't provide one, just make them wait 30 seconds. This discourages
about 25-30% of spammers and doesn't bother genuine mail servers. As it
happens, I don't run an ident server myself, but then I don't send much
email.
I would hope that Exchange 2007 has DNS lookup and testing facilities,
or that it develops them soon, as they are extremely effective. The
world isn't moving towards SPF very quickly, and while the majority of
large ISPs are fairly picky about accepting email, none of them seem
bothered about their own customers' computers sending spam, apart from
AOL of course. All the other 'difficult' email domains, Comcast, Yahoo
etc., turn up regularly in my logs.
--
Joe