Blocking spam using APEWS.ORG

Something that is working came about because spammers ignore published procedure. Let me explain that, an email gets sent based on what the DNS records say about the domain name in question. If I have example.com then I may want to have a website that people can find either at example.com or www.example.com. We do that by creating a blank "A" host record and another for www thus creating the desired prefixes.

Email servers can be setup for a domain by creating "MX" records in the DNS and set the priority value for each. One basic system is to have 2 public IP addresses and create an MX record for each but give one a priority value of say 1, and the other a value of 2. The physical email server that is on the IP address corresponding to priority 1 will be the first recipient of domain emails. Only when sending servers find that server & IP address to be unreachable or busy will emails start to be tried at the second server & IP address corresponding to priority value 2. In this way you have published your preference of how sending email servers should attempt to deliver emails to your domain.

What I have found is that spammers send their spam to all MX IP addresses and the root "A" record IP address in addition. Taking the above example you would have a web server on one IP address and 2 email servers on another 2 different IP addresses making 3 external or public IP addresses in total. You expect web traffic to go the www IP address, and the majority of your emails to go MX1, with MX2 acting as backup or failover.

Nice idea but spammers don't follow your preferences since they are only interested in successful delivery. They will attempt to deliver spam to all 3 IP addresses and if your web server should have an email server program listening on port TCP 25, it will receive connections from spam sending bot infested computers etc.

My tip is to separate the traffic by design. Staying with the above simple setup, MX1 is the primary email server on one IP address and MX2 is the secondary. Your web server is on a 3rd IP address and does not handle inbound email therefore it does not have a MX record. That means that it should never receive email and depending on web server traffic, you could choose to have the web server handling outbound emails from the website and / or authorized domain users. It may be that due to high traffic levels you dedicate a 4th server to outbound emails and give it a different IP address to the above. The point is that inbound emails should only ever arrive for delivery at MX 1 or if busy, then MX2.

These days email Administrators must use a whitelist of trusted email server IP addresses. There are some very good databases online and I intend to cover that topic shortly for anyone still unaware or unsure but it is essential in order to avoid false positives. Setup your email server to check the connecting IP address against your whitelist and accept for delivery from all that are listed.

Any IP address that has a server connecting to your server and is not on that whitelist is unknown to you and therefore untrusted. The public whitelists have come about by Administrators sharing their trusted IP address details so if an IP address is not listed there, that means a lot of network Administrators do not trust the IP address either!

Starting with MX1, your primary email server, set that to accept all inbound email even if it comes from IP addresses that are not listed in the whitelist. Now have the email server check the IP address against the L2.APEWS.ORG either in realtime at the online database or your local copy that you obtained via RSYNC (another topic for the near future). If your server finds the connecting IP address to be listed at L2.APEWS.ORG, have the email program create a X-Header which can later be used in filtering. Your server then accepts the email for delivery and transfers all thsuch emails with the X-Header to the recipient's Spam or Junk folder.

You can configure your secondary email server MX2 in exactly the same way if you want to, or if the primary server MX1 is handling the majority of emails, you can set this one to reject emails from IP addresses that are listed in L2.APEWS.ORG. Your outbound email server and web server too, if it has an email program running, should be set to reject inbound emails that come from APEWS.ORG listed IP address space. You will only get a false positive if your whitelist is inadequate, remember that the EWS in APEWS stands for "early warning system". I intend to publish here the false positives that we get in the hope of them being delisted by the APEWS.ORG Administrators which helps everyone, more folks should do the same.

The above is currently working on several commercial servers with excellent results. Due to the whitelist on each email server followed by APEWS, 99% of spam is correctly identified. Spammers are getting the 550 error message (which they always ignore) but more importantly, failed delivery. These results are before any after-receipt filters or client side filters.

Do not put Yahoo, Hotmail, Gmail, and the other web-based email servers in your whitelist as we have found that they get used for list washing and can overwhelm your servers. You will find that APEWS.ORG do not have them listed either so you won't lose any emails from their senders. I recommend an alias list that handles mis-spelled email addresses by routing common errors to the correct user email address, and then reject all emails for unknown user names / email addresses. It's all about reputation now, trusted senders are more easily documented as they are so few.