Is it time to outsource my mail processing? (Full Version)

All Forums >> [Content Security] >> GFI MailEssentials for Exchange/SMTP



Message

funkyd -> Is it time to outsource my mail processing? (4.Jun.2008 5:39:30 AM)

 
In the last seven days our mail server has received 1.6 million emails which GFI rates as 100% spam.

From time to time people say they haven't received emails which seems to be down to the fact that no matter how many SMTP connections I allow, the server gets swamped. If I open say 50 connections then people complain that mail is not received and it ends up on our backup server and then never gets to us because it can't connect to the main one.

If I open more connections then the server can't cope and queues build up.

What is the right solution? Should we dump it onto one of these 3rd party mail handlers (will that make any difference?) or is it a case of setting up GFI differently?

I have a single perimeter SMTP server running both GFI products and with a SQL express database for logging.

I tried putting the SQL database internally but it was too slow.

Should I perhaps look at putting the two GFI products on separate boxes?

A second SMTP server to simply receive all mail and queue it for GFI so at least we can receive the mail?

Processing seems to be the issue - the server is nearly always at 100% - memory is not too bad - it has 1.5GB and (running on VMware ESX server) never seems to go much above 25/30%

I'm wondering what my next step should be - there are only 50 users and the actual volume of mail they need to receive is only about 100 - 150 or so a day.

Anyone else have such a large ratio of spam to legitimate email? Is there anything I can do to stop us receiving it in the first place? I thought about blocking IP addresses on our Firewall or even root domains but I can't see any real benefit.

It seems no matter what I try the volume of spam is like trying to fight a bush fire with a watering can!



mattbern -> RE: Is it time to outsource my mail processing? (4.Jun.2008 9:38:01 AM)

it mgiht help if you posted your machnie specs as well as all of it roles

I would say   a front end / backend configuration would help alot



funkyd -> RE: Is it time to outsource my mail processing? (4.Jun.2008 9:50:23 AM)

quote:

ORIGINAL: mattbern

it mgiht help if you posted your machnie specs as well as all of it roles

I would say   a front end / backend configuration would help alot


My server is running on VMware ESX, 1.5GB and is dual core.

I have two physical drives, one for the OS etc and one for IIS, database log files and GFI logs.

What do you mean by front end / back end? My Exchange server is not on the same box so can I split it up much more? Maybe but each GFI product on a different box?

I can't believe the ratio of spam to legitimate email - is everyone else like this? What could be the cause?



John Letourneau -> RE: Is it time to outsource my mail processing? (4.Jun.2008 10:00:09 AM)

funkyd,

This is a situation where load balancing could come in handy or perhaps configuring certain modules in GFI MailEssentials to delete the messages instead of passing them to your Exchange server. 



funkyd -> RE: Is it time to outsource my mail processing? (4.Jun.2008 10:07:06 AM)

quote:

ORIGINAL: John Letourneau

funkyd,

This is a situation where load balancing could come in handy or perhaps configuring certain modules in GFI MailEssentials to delete the messages instead of passing them to your Exchange server. 


So two servers? Won't they just max out? It seems whatever I do the volume of spam simply increases to match. I would expect this level of spam if we had a few 1000 users but there are only 50 and perhaps only a dozen or so that use email externally on a regular basis.

I do delete most messages - the only ones forwarded to a mailbox for checking are ones where words are found or there are attachments. All the DH emails are deleted as are SPF emails (set to low because of false positives) as are DNS blacklists, Bayesian, Spam URI.

My module order is:

Whitelist
DH
Phishing
SPF
Custom blacklist
DNS blacklist
SPAM URI RBL
Bayesian
Keyword whitelist
Header
Keyword
IP whitelist




nhbill -> RE: Is it time to outsource my mail processing? (10.Jun.2008 2:02:07 PM)

postini by google or MS hosting filtering I've been eyeing it for awhile now.



rralston -> RE: Is it time to outsource my mail processing? (17.Jun.2008 9:04:35 AM)

I would suggest changing the module order somewhat. Right now, your ME box has to do DH lookups on a lot email that should most likely just be deleted without question. This might be slowing your server down.

Try making these 2 first, as they catch a lot of junk:

Phishing
SPAM URI

The others are more subjective in my opionion, and based on your business requirements, but I always put Bayesian last, since it is the most "fuzzy". I figure if it has gotten past everything else, I'll let Bayesian have a final look at it.

For reference, my overall ordering:

Phishing
SPAM URI
IP Whitelist
Email/Domain whitelist
Header Chk
SPF
Custom BL
Keyword Whitelist
DNS BL
Keyword Chk
DH (Although I have had to disable this for now as it is not working correctly)
Bayesian

Hope that's helpful.

Rob Ralston



Page: [1]