On 12/8/2010 12:34 PM, Chris Owen wrote:
On Dec 8, 2010, at 2:29 PM, Marc Perkel wrote:
Virus bots tend to hit all MX records, perhaps randomly. I get millions of hits
every day on the highest numbered MX when there are at least 2 and sometimes as
many as 7 lower numbered MX records.
We too very often see spammers hit the highest MXs first. I think the theory
is that spam controls on those might be less. A theory that is probably
valid much of the time.
The other thing we see that always amazes me is that if we have MXs that are
all the same weight, the ones that have the lowest reverse DNS host name get
hit higher.
So for use we use inbound1 through inbound4 as the host names. All four have
the same MX weight. DNS gives out the names in random order when you look up
the MX records. Yet inbound1 gets hit almost twice as much as inbound2 and
inbound 2 is almost twice what inbound4 is.
I really have no idea how much less why this happens. It is sort of
frustrating though as it leads to load imbalances.
Chris
For those who want to try the Fake MX trick you can set your highest MX
to tarbaby.junkemailfilter.com. I'm harvesting spambot data for my black
list. It's a free way to get rid of some spam and punish the spammers.
--
Marc Perkel - Sales/Support
supp...@junkemailfilter.com
http://www.junkemailfilter.com
Junk Email Filter dot com
415-992-3400
