Re: Q. about spam directed towards highest MX Record?

[Peter H. Lemieux]

Jon Trulson wrote:
Hehe, that is an old spammer trick... Our secondary MX is
pretty much 100% spam.
I implemented greylisting on the secondary which reduced spam
through it by about 99% :)  The secondary does not do spam
scanning, it's simply store and forward.  Greylisting really
helps in these cases.

My experience is like Jon's; nearly all mail arriving at the backup MX is 
spam.

Rather than greylisting, I simply score messages higher if they come in 
through the backup MX.  On my systems, where the primary MX is almost 
never down, I add 3.3 SA points for messages that arrive via the back 
door.  This is routinely one of the most frequently hit rules, right up 
there with senders without reverse DNS, which gets an equivalent score. 
Many messages arriving at the back door trip both these rules and thus 
get marked as spam.

This approach doesn't put a great deal of stress on my SA scanner because 
I block a lot of mail at the SMTP level based on a substantial custom 
rule list.

Peter