SoCal Websites

Spam can cause problems with exim when it is both incoming and outgoing. Recently, we started getting excessive resource usage notices for two different customers. At first, it looked like their mail accounts were being used to spam the server.

After further analysis, we realized it was actually that the domains were being bombarded with spam to their accounts. Exim was raising the server load dramatically, because neither account had the default address set to :fail: no such address here.

By using :fail:, “the email is never accepted into the server. During the initial SMTP negotiation when the senders SMTP server connects to your SMTP server, the sending SMTP server issues a RCPT command notifying your server which email address the email to follow is intended for. Your server then checks whether the recipient email actually exists on your server (a POP3 account, an alias or a catchall alias) and if it does not, it issues an SMTP DENY which terminates the attempt to deliver the email.” (source: ConfigServer)

These two accounts were being bombarded in such a way that they actually brought the server to a crawl by not having the default address set to :fail:.

So in your cPanel installations, you should make sure the default address is set to :fail: for all accounts to ensure a safe, stable hosting environment.

In WHM, if you go to “Tweak Settings” under “Server Configuration,” you can set the default for new accounts to go to :fail: and prevent high server load from mail attacks.

Share This

Subscribe to the comments through RSS Feed