I've JUST started working with some important servers and recently all of them have received pretty heavy spam attacks, they get filtered and dont effect any of the servers processing power tis just a minor annoyance.

Like I said, this is a pretty new job and I'm a bit of a linux newbie so I don't wonna delete thousands of emails which are from genuine users or anything, just some basic advice would be nice.

Thanks for the help guys

Rejecting mail for invalid/unknown users is a good start if you don't already

Genderbender

What MTA are you running? I was in the same boat a couple of months ago when our postfix queues started soaring and mail started to become delayed on our gateways. I don't know the cause but we had to go to our DR servers in another state, which caused even more problems when we started dropping messages since we did not have valid relay domains specified in our postfix config. We discarded roughly 1000 messages from our company's email server but luckily I did not get fired due to a misconfig that another admin made. We rebuilt the mail servers with a fresh install of Solaris and had our mail gateway vendor send a conslutant to give us a run down of how everything works. Long story short you should get very familiar with your MTA and the software you are using. We use puremessage its fairly good but its commerical. It does a great job of blocking spammers and rejecting mail at the MTA level like billmayday stated it also has a great policy. I am sure Postfix has great spam utils such as greylisting, etc but you need to double check your configs to make sure everything is proper. Check the queues frequently as well making sure active and incoming queues are low are or you'll start getting delays.


Thats my 2 cents.