Email hosting problem with 365

thedesigntribe

Hi all,

Don't know if it the correct place to post this but the hosting forum been shut.

I host 6 domains with 365 and have run into a problem with one of them.

One of the domains is receiving an enormous amount (4gb per month, 50000 mails a day!) of unsolicited email. This is playing havoc with my allowed traffic setting.

I have been on to 365's the helpdesk (they've been very helpful) but I am unsatisfied with the out come of my questions. I have NO reason to disbelieve what I am being told by 365 - but I want to run it by you peps.

365's helpdesk have told me that all of the unsolicited email is coming into non-existing accounts (i.e. blah-blah-1234-whatever@mydomain.com), also I have been told "I went through the logs, and the spam is not coming from any one place.". I have also been told that the outgoing mail from this domain is normal (half a dozen a day).

I also checked out the computer collecting these email accounts and all is well, its sending & receiving 10approx emails a day & has no viruses - so it definitely an incoming email problem (as told by 365).

365 have told me the only way around this is to purchase their anti-spam service (€99 per year per domain) and have offered me a "significant discount" - which is nice of them.

So to recap, I'm receiving tons (4GB) of unsolicited email to non-existing accounts & is messing up my hosting account.

My big issue with this is - what happens if this start to happen to the other 5 domains I host with them? All of a sudden every domain I host increases in cost by €99 per annum! and I need 24GB per month just to take all this email which is being refused at the server point. As I spend close to €400 per yr hosting with them - I was planning to move over to a reseller account soon! (needless to say this is off the books until this is email issue is resolved).

Maybe you can help with these questions:

1. Is it a common occurrence?
2. Has anyone experienced this problem before?
3. Is their any way out of it with out buying a load more traffic & spam service?
4. Why should I have to play for email coming to non-existing accounts just because I own the domain? (stupid question I know - I'm just annoyed :-)

Note: I've been with 365 for 5 or 6 years & always been happy with them but this issue stops me in my tracks - imagine if I had 100 domains hosted with them & could happen to all of them!

thedesigntribe

Stephen*, has just been on to me, highly unusual stuff happening alright - he's looking into it in the new year.

Has anyone seen this type of thing before?


(* the mans dedication to customer service is brilliant as usual)

cgarvey

thedesigntribe wrote:

[*]Is it a common occurrence?

'Fraid so, although you do seem to have it pretty bad.

thedesigntribe wrote:

[*]Has anyone experienced this problem before?

Yup, it happens alot with almost all of my c/n/o domains. Less so for .ies

thedesigntribe wrote:

[*]Is their any way out of it with out buying a load more traffic & spam service?

There are lots of technical solutions to ease the problem (though not eradicate it completely). The mail server can be configured to reject mail destined for a non-existing user. High-volume mails servers are often just configured to blindly accept mail for a domain they host for, and then worry about whether or not the user at that domain exists, later. Unfortunately, for you, by that time you've incurred the bandwidth cost of the full mail. I can't offer advice on H365's setup, but it's possible to do that user-actually-exists at SMTP time on all common mail servers.

If you have the ability to setup a "catch all" address, then reconsider reverting to finite aliases (including some common typos, etc.). If H365 do a user check at SMTP time, this will result in the mail being rejected before the DATA is sent, which will significantly reduce the bandwidth consumed. Depending on how H365 monitor the SMTP bandwidth, it may even eradicate the problem.

thedesigntribe wrote:

[*]Why should I have to play for email coming to non-existing accounts just because I own the domain?

Annoying, sure, and that's why spam is such a big pain, because the innocent recipient pays the price (as against receiving unsolicited post, for example). However, it is your domain, you are responsible for it. That may mean availing of H365's spam control service, or moving to another host (some hosts offer that for free, for example).

daveirl

This post has been deleted.

thedesigntribe

I don't know dave [knowledge gap], I'll put it to the 365 boys.

Cheers for the tip

mneylon

It sounds like you have a catchall enabled. Disabling it should make your problems go away.

thedesigntribe

I checked and none of the 4 email accounts for this domain have catch all DISabled.

13th of January & this one domain has taken in 1.5GB's of mail. It's all being dumped at the server level. It my mother-in-law's domain www.ontariohouse.net & I have checked the machine that collects the email - its clean.

Another oddity that's happening - the disk space is slowly being eaten away. I keep getting email alerts warning of disk space reaching its limits.

11-01-05: used 235.83 MB out of 250 MB limit
12-01-05: used 235.96 MB out of 250 MB limit
08-01-05: used 236.57 MB out of 250 MB limit

There are no database nor has there been any FTP transfers since before the 11th. Is this normal?

mneylon

You should really take it up with them directly.

LoLth

This is actually an all too common occurrance. All I can say is that the H365 Spam filtering service is actually quite good. It uses a Barracuda box to check and any clients that have signed up for this service (some of my clients have h365 hosting) have noticed a significant drop in the amount of spam.

As for the catchall enabled or not, check with H365 directly. Maybe ask them to recreate the mailbox in case there's something gone wonky in the background.

definitely give H365 a call. As revenge against spammers I would suggest you sign up for project honeypot... I'll post linkage later.

mneylon

LoLth wrote:

As revenge against spammers I would suggest you sign up for project honeypot... I'll post linkage later.

Revenge against spammers is pointless.
Forcing ISPs/hosts to implement a proper anti-spam policy and lockdown open relays is the way forward.
Reporting spam to the likes of spamcop.net is a good way of helping block spam networks.
Unfortunately Irish legislation on spam is very weak and the reporting mechanisms are archaic.

tom-thebox

"Hosting365 said it has managed to detect more than 99 percent of incoming junk mail since implementing the Barracuda Spam Firewall. The hosting company also said the firewall has reduced the load on its mail server by at least 60 percent. Barracuda Spam Firewall is distributed by Radius Technologies in Ireland."


http://www.enn.ie/news.html?code=9542799

mneylon

Barracuda is run by a "reformed" spammer:
http://www.rhyolite.com/anti-spam/objections/mperone.html

It has also received a lot of criticism from people in the anti-spam community for its backscatter due to misconfiguration.

tom-thebox

Could this be the performance problem folks?

http://forum.psoft.net/showthread.php?t=10283

thedesigntribe

thedesigntribe wrote:

I checked and none of the 4 email accounts for this domain have catch all enabled.

Dooh!

Sorry I meant to say DISABLED

steve-hosting36

Hi Tom,

No, that was a test install, we dont use the Hsphere spam filters.

THe forums are not really supposed to be a tech-support system, we're looking at this issue at the moment and will get back directly to the trouble ticket.

tom-thebox

steve-hosting36 wrote:

Hi Tom,

No, that was a test install, we dont use the Hsphere spam filters.

THe forums are not really supposed to be a tech-support system, we're looking at this issue at the moment and will get back directly to the trouble ticket.

Ah right sorry Steve you are prefectly right these are not support boards, excuse my above comment.

LoLth

Seeing as this matter is being dealt with by H365 and has become more of a tech support issue than a process/spam enquiry I'm going to lock it.

Good luck theDesigntribe. Hope it all works out well for you.