Last weekend, I noticed my mail server constantly getting hung up. There were 15 processes in 'cmd read' state and sendmail had a limit of 15 processes. Several times I had to shut down and restart sendmail. There was nothing in the logs indicating why it was hanging.
I figured this would be a good time to switch my mail to my other machine. A while back I installed qmail but never had the guts to throw the switch. Now that my mail system was hanging I figured I had nothing to lose. I guess I had set it up correctly because it worked fine.
I had found a real good greylisting program that plugged into sendmail. When I originally turned it on, it seemed to cut my spam by about 90%. So I went looking for a greylisting program for qmail. Qmail can be built with a patch that allows the smtpd program to accept plugins and one of the plugins is a greylisting program. Fortunately, Gentoo has a USE flag that builds qmail with this patch applied. I downloaded and installed the greylisting plugin and noticed a sudden drop in the rate of spam messages to my inbox.
One thing that's nice about this particular greylisting program is that it uses a database. You can look in the database to see what hosts are trying to send you mail. If you can determine the system's legitimacy, you can drop the system's IP address and some other information into another table and the node is whitelisted or blacklisted.
I threw together a web page to allow me to monitor what's getting through my mail server into inboxes. If the node names look phony, I plug the name into my browser to see what comes up. Most of the time it appears to be an email marketing company. I blacklist these and any other IP addresses mentioned in the system's MX and SPF records. It's so nice of the spammers to post a list of their machines in an SPF record. I can knock off an entire class C with one blacklist record.
I'm surprised that many of these addresses don't show up in the DNSBL servers. My configuration references about five of them but the only one that actually seems to flag spam is spamcop.net.
In researching spam control methods, I started looking into SPF a little more. From what I've seen, many SPF entries are practically worthless. I guess it's too hard for some folks to figure out a comprehensive list of machines that can send mail for their domains so they end the SPF entry with '~all' (probably not but maybe) or '?all' which basically says "we won't confirm or deny whether any other addresses may or may not send mail for this domain". Also, if I understand the SPF documentation correctly, a 'ptr' entry would allow anyone that has control of their own reverse mappings to pump email from your domain. Google's SPF entry? "ptr ?all". Worthless.
Anyway, the mail is flowing again. I need to check what gets through the greylist a few times a day and move some entries to the black/whitelist but the only spam that appears to be getting through are 419 and lottery scams. The marketing stuff has pretty much dried up.