There issue has been fixed with hotfix 4 you need to have a Mcafee service
agreement to get it though.
30. This HotFix resolves an issue with Fully
Qualified Domain Names. Mailscan was
distinguishing between FQDN's and domain
names without a trailing dot.
Robert Everland III
Dixon Ticonderoga
Web Developer Extraordinaire
-----Original Message-----
From: R. Scott Perry [mailto:[EMAIL PROTECTED]]
Sent: Wednesday, February 13, 2002 11:43 AM
To: [EMAIL PROTECTED]
Subject: Re: [IMail Forum] Is Webshield safe?
>By 7:30 this morning webshield aka mailscan was consuming 70% to 88%
>of our processor resources. In addition when I looked at the webshield
>statistics it showed we had passed 128 thousand messages in two hours
>which I find very difficult to believe. In fact when I restarted
>webshield it jumped
>immediately to over 200 messages processed. I am not sure I am confident
>it is ONLY counting messages. I will examine the logs to see what the
>truth was later.
It sounds like you got hit by the WebShield DoS issue. You need to tell
WebShield the local domain names twice, once as-is, and the other time with
a dot at the end. For example, if you host "example.com", you need to give
WebShield both "example.com" and "example.com.". Otherwise, a malicious
hacker or someone accidentally mistyping an address will cause WebShield to
send an E-mail back to itself continuously, growing in size each time as it
adds a Received: header. The symptoms you describe match this exactly.
>We have about 54 domains all of which I had to tediously enter into
>Webshield along with the "domain.com." aliases.
In that case, it sounds like you already know about the problem.
Have you checked the spool/queue to see what messages are in there? Or,
you can check the log files to see who the E-mail is from/to, to get a
better idea of what is happening.
-Scott
---
Declude: Anti-virus, Anti-spam and Anti-hijacking solutions for
IMail. http://www.declude.com
---
[This E-mail was scanned for viruses by Declude Virus
(http://www.declude.com)]
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
