Re: Getting hammered by backscatter - possible solution: vbounce?
>> We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin[color=blue][color=green]
>> built-in. At the present time, my mailbox is filled with
>> backscatter; getting around 10 a minute since 4:30 today. I have
>> postfix backscatter rules in postfix of zimbra,
>> [url]http://www.postfix.org/BACKSCATTER_README.html#real[/url] but still
>> getting pounded.[/color]
> Shouldn't the vbounce ruleset help here?
> I'm asking because me and my users have the same problem and I am
> currently considering giving the ANY_BOUNCE_MESSAGE a higher score
> but I am not sure yet whether it's a good idea or not.
> How is your experience with vbounce? Is it safe enough?
> (the ML archives don't show too many complaints...)
> Anyone out there who raised the score of ANY_BOUNCE_MESSAGE
> and did not drown in user complaints? :-)[/color]
It certainly helped in my environment with the user requests, but had
one unfortunate side effect: E-mail forwarded from another account to an
account on our servers was considered a "bounce" because it hit
I ended up modifying that rule as it didn't seem to hit any bounces that
didn't already get hit by the other rules. Otherwise vbounce does a
reasonably good job of marking bounce messages. If you don't have users
forwarding into or out of your mail servers, then you probably don't
have anything to worry about on that front.
If you're just filtering to another folder it won't really change the
fact that messages are coming in though. I've still had a couple of
users complain about their SPAM folders getting 100s of bounce messages
an hour, and in those cases I specifically ended up filtering the SPAM
bounces to the bit bucket.
YMMV, so I recommend testing the rule with the default score (i.e. not
using it to mark SPAM) first.
Earl (Bob) Kinney
Manager of Research Computing
Harvard-MIT Data Center