HMail delivery queue full with unsuccesfull spam

email-serversmtpspam

Since a day or two the mail delivery queue of the hMailServer is exploding because someone is trying to send spam via this server. Though the e-mails aren't successfully sent it fills up the mail queue.

All SMTP connections require smtp-connections and also the log shows '530 Authentication Required'.

Also the mails are sent via a non-existing mail-account. (Service@website.com)

Below images show the queue and a part of the log.
enter image description here
enter image description here

Is there anyway I can stop the queue from filling up? Auto-ban is enabled but doesn't seem to help.

Best Answer

The first thing I would try is to configure some dns RBL, http://www.hmailserver.com/documentation/latest/?page=reference_antispam

If it is correctly implemented you will have messages blocked before the SMTP exchange has begun, and nothing created in the queue. You could begin with spamhaus xbl and/or sbl, there are relatively safe and might greatly help your problem.

The second thing I would do is have a look at the COM api:

You have a DeliveryQueue object which you can use to clear the queue. This might not be the best solution but it's always better to script it and run it on a scheduled task than having to open the gui and click manually on "Clear Queue". Once you have a basic script you can enhance it, for example by running the Clear() only if the queue size is above a certain threshold..

Then if the incoming traffic is so high that even with some good DNS RBLs and big automated clearing of the queue your server can not stand the traffic I would look for setting up an MX server somewhere else and configure it to shield your server from such attacks. A lot of unix-based server will probably handle these situations more efficiently, and you can have one on a vps for a small monthly amount.

Related Topic