Guys,
We've been using qmail-ldap for a while now for our customers, and one of the biggest problem we have is that usually get hit by an infected customer system that spam every major ISP out there which caused us to be blacklisted everywhere. The only way to detect this is after we are being blacklisted, customer complains and we start troubleshooting. We have to find the offending IP address (I use qmqtool -i to do so), remove all the email in the queue with that IP address and then request our IP address to be removed from those ISP blacklist.
Suffice to say, our customers are not very happy with the frequency of the down time and I was wondering if there is anyway to detect this type of activity that can cause us to be blacklisted before we are blacklisted. This is not a question for incoming spam filter, but outgoing email filter. Maybe some sort of trend detector. I have tried tarpit but that only slows them down and do not solve the problem. Tarpit also does not help if they open multiple connections.
Thanks in advance,
Hadi
