Re: How to block a ddos attack?

[Zdravko Stoychev]

Hi! It may help to block with blacklists (i.e. zen.spamhaus.org), additionally it may help to block IPs without reverse DNS. Using RBL check to using several of them to different blacklist DBs is a must nowadays. I am not sure if this is really a DDoS, its sounds more like daily life for any SMTP server these days. Still it happens that a certain e-mail address is used in a huge spammers session, and it might happen for a period of several days this e-mail will receive unusual amount of bounces, fake e-mails and bogus responses (read from AV, AS software, etc.) So it's a kind of DDoS. Thus your server should be able to handle it = add more RAM, put better CPU and so on. We currently have 3.7 percent of legitimate mail traffic on our servers. 96.3 percent is junk. Right, indeed! Same here. The blacklists and reverse DNS checks let us drop 91.9 percent of the connections before SMTP really starts. So our servers have to deal with only 8% of the connections. Your mileage may vary. This is good. But one should also use other techniques. Add SPF, DomainKeys, DKIM checks and enforce their policies. And the most important, which alone will fight about 70% of RBL-check missed e-mails, is the Graylisting technique. With all this implemented, your mailbox shall hit 2-3 SPAM e-mails per week. Not bad :) Regards Alain Wolf Hope this helps, and regards! -- Zdravko Stoychev IT Administrator MPS Ltd. 63, Shipchenski Prohod bul. 10 floor, office 105 Sofia 1574 Bulgaria Work: 0035924911827 Mobile: 00359888243118 Fax: 0035929733836 Email: [EMAIL PROTECTED] IM: 11693613 (AIM) My Professional Profile My GnuPGP Public Key EC7E CA74 952D F343 2AAD 0F34 857D E27D 2C64 101C See who we know in common Want a signature like this? "If someone is going down the wrong road, he doesn't need motivation to speed him up. What he needs is education to turn him around." - Jim Rohn This e-mail is intended only for the addressee(s) and may contain privileged and confidential information. It should not be disseminated, distributed, or copied. If you have received this e-mail message by mistake, please inform the sender, and delete it from your system.