The spammer was trying to get the BCTS mail server to relay their spam so it would appear to come from somewhere else. spammers typically use a double relay to increase their indetectability. The spam traffic was coming from multiple sources of the first leg relay, seeking to be relayed again. You have to configure your mail server so it rejects this bad traffic as early in the mail cycle as possible. A recent advance in spammer know how enabled them to send traffic that confused spam assassin, which they hoped would let the relay happen. But our system was tight enough to prevent the relay but the confused spam assassin used up so many resources it cause crashes of other programs, like the database manager.

Spammers want to send spam because they actually make money off of it. And that takes more explaining than I'm willing to do right now.

Basically, spam assassin is designed to grab spam by the scruff of the neck and send it flying out the back door onto the ash heap. Bob's solution was to figure a way to simply kick 98% of the spam in the teeth coming in the front door so we could let spam assassin deal with only the wiliest spam.

Pluses, besides the system actually running are that now even less spam gets through to my mail box. :) And Bob went and made similar mods to his own servers.

Hugs,
Erin

= Give everyone the benefit of the doubt because certainty is a fragile thing that can be shattered by one overlooked fact.