[quote user="PaulW"]

Another configuration that has been used with success when you do not have the backup servers under your control, is to have the highest MX the same as the primary MX.  Malware will be stopped as usual by the primary, while the real backup servers will be relaying mainly good mail.

[/quote]

I've just tried this with my domain and it seems to be pretty effective.  I usually have about 150-200 spams in the spam account each morning and the last two days this has been reduced to about 80.  I color the spam that comes in via the MX host and that is much reduced.  On the negative side, more and more spammers are retrying and so get through the Graywall. ;-(

When I was an ISP I ran a primary and secondary SMTP server. The secondary just forwarded mail to the primary.  What I noticed was that the secondary server handled more spam than the primary. As a test I set up a third SMTP server with the highest preference and found that the spam load shifted from the secondary to the third.  For some reason spammers often pick in the server with the highest preference.

With this in mind I wrote a simple SMTP server that would issue a 452 to any connection. This reduced the spam load on my primary server by at least 50%. This presented no problem with the flow of legitimate mail as any self respecting SMTP server would try the primary, secondary and then the third. if all three fail then the message is queued for retry. The only time I ever had any problem was when another ISP had corrupted cache on their DNS server, flushing the cache fixed the problem.

Useful idea.  Could this be achieved with Graywall set with unlock time higher than expire?

Another configuration that has been used with success when you do not have the backup servers under your control, is to have the highest MX the same as the primary MX.  Malware will be stopped as usual by the primary, while the real backup servers will be relaying mainly good mail.

The whole point was to relieve the load on the primary server. The spam load was huge and caused some slowdowns. Cooperate users have no sense of haha.