Mail Filtering News

28jun2005 - MX Switchover

Since I'm now ignoring all the crapmail sent to acme.com, I started thinking about whether there might be some use for it. I asked around and found two different organizations who were interested in getting it, as a massive source of spam and virus examples. Sending it to them is a simple matter of changing the MX record for acme.com - or is it?

It turns out that many crapmail senders ignore MX records! I kind of suspected they might, so I did the switchover in three phases to look for this effect. First, a couple of days ago, I re-enabled mail reception on acme.com, to get back my baseline. Then yesterday at noon I changed the MX record. I let things run that way for 24 hours, to make sure that the new record had a chance to propagate throughout the net. Then at noon today I turned off acme.com's mail reception again.

The graphs are on the right. They show that switching the MX record caused a drop-off, but only by 50% or so. Around half the mail was still being sent here, despite the MX record saying to send it elsewhere. I think that's pretty interesting.

Anyway, my IP-address block is back in place now, and the crapmail is being sent off where it can do some good.

Back to Mail Filtering News.