From owner-freebsd-isp@FreeBSD.ORG Mon Feb 21 04:36:18 2005 Return-Path: Delivered-To: freebsd-isp@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 5192A16A4CE for ; Mon, 21 Feb 2005 04:36:18 +0000 (GMT) Received: from wjv.com (fl-65-40-24-38.sta.sprint-hsd.net [65.40.24.38]) by mx1.FreeBSD.org (Postfix) with ESMTP id 4DE6743D5C for ; Mon, 21 Feb 2005 04:36:17 +0000 (GMT) (envelope-from bv@bilver.wjv.com) Received: from bilver.wjv.com (localhost.wjv.com [127.0.0.1]) by wjv.com (8.12.11/8.13.1) with ESMTP id j1L4aEHZ021410 for ; Sun, 20 Feb 2005 23:36:14 -0500 (EST) (envelope-from bv@bilver.wjv.com) Received: (from bv@localhost) by bilver.wjv.com (8.12.11/8.13.1/Submit) id j1L4aD5m021409 for freebsd-isp@freebsd.org; Sun, 20 Feb 2005 23:36:13 -0500 (EST) (envelope-from bv) Date: Sun, 20 Feb 2005 23:36:13 -0500 From: Bill Vermillion To: freebsd-isp@freebsd.org Message-ID: <20050221043613.GA21273@wjv.com> References: <4219551F.9010808@pyramus.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4219551F.9010808@pyramus.com> Organization: W.J.Vermillion / Orlando - Winter Park ReplyTo: bv@wjv.com User-Agent: Mutt/1.5.6i X-Spam-Status: No, score=-2.8 required=5.0 tests=ALL_TRUSTED autolearn=failed version=3.0.1 X-Spam-Checker-Version: SpamAssassin 3.0.1 (2004-10-22) on bilver.wjv.com Subject: Re: Why the mail error for domains I don't host? X-BeenThere: freebsd-isp@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list Reply-To: bv@wjv.com List-Id: Internet Services Providers List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 21 Feb 2005 04:36:18 -0000 The door open and in walked trouble - disguised as our our old nemesis Blake Swensen, who uttered, at Sun, Feb 20, 2005 at 19:27 : > sendmail[93922]: j1L2kZa5093920: SYSERR(root): > mx1.distinguish.com. config error: mail loops back to me (MX > problem?) > I know everyone has seen this message at least once in their > life from improperly configured sendmail. However, my log is > filling up with these messages for domains I do not host.... and > when I dig the mentioned host, it always resolves to localhost > (127.0.0.1). This happens over and over again on for domain > after domain. Are there really that many unskilled admins who > publish their mail server's address as localhost, or is this > some sort of hack that I should worry about? I won't call myself unskilled - but I have one domain that in desperation I set the MX record to localhost. I was running about 300,000 spam messages PER DAY to that domain. Removing the MX record entirely cut me down to 25,000 to 50,000 per day - as people would send the spam to the IP of the web server. [both web and MX are on that one machine for a few domains]. I know it's not supposed to be done, but I did this in self-defense. The domain in question has been coming up #1 in Google, MSN, and other search engines for the past 5 or so years - because it's on of those domains that has a great name. During the height of the dot-com boom the owner was offered $250,000 for the domain - $10K in cash in the rest in stock - which was the sign of the times then. We're heading toward our peak which is typically March - and that's about 7000 sessions/day and about 325,000 hits/day. Sorry if this site is giving you problems, but I'm open to any suggestions that will keep the spam away and the 127.0.0.1 is the only one I could come up with. None of the other domains is set up this way - and all the mail we host is for commecial sites - with no end-user/home accounts at all. Bill -- Bill Vermillion - bv @ wjv . com