Thank you Paul. It sounds like your situation is close to ours in that
we have lots of lists created and populated by automatic processes
(though nothing near 60,000!). I will discuss the per-domain quarantine
issue with our firewall people and see about getting an address set up
to receive the posts.

-aht

-----Original Message-----
From: LISTSERV site administrators' forum
[mailto:[log in to unmask]] On Behalf Of Paul Russell
Sent: Tuesday, March 20, 2007 1:15 PM
To: [log in to unmask]
Subject: Re: A Listserv behind a spam firewall

On 3/20/2007 12:59, Tim Casten wrote:
> Glad to see this post. We current have a cuda in front of our mail
server 
 > and are now purchasing one for the listserver.
> For starters each list will have to be a user in the cuda. 
> And I believe that is all that will be needed to be done. 
> Just my opinion like I said we have not set ours up yet. 
>

We have been using a Barracuda Spam Firewall as the MX host for both our
central email service and our list service for approximately 18 months.

For the nd.edu domain (our central email service), the Barracuda is
configured to perform LDAP validation of recipient addresses, unify
email aliases using the user's enterprise userid, and create quarantine
accounts for individual users. Individual users may change their spam
settings, up to and including disabling spam filtering for their own
accounts.

For the listserv.nd.edu and lists.alumni.nd.edu domains (virtual hosts
on
the same server), the Barracuda is configured to use per-domain
(global),
rather than per-user, quarantine. To do this, we had to specify an
address
to which "quarantined" messages are delivered. We created a mailbox for
this
purpose on our central email service. I check this mailbox once or twice
a
day. After redirecting legitimate delivery error messages to the
appropriate
owner- addresses, I sort the remaining messages by subject line and
visually
scan for anything that appears to be legitimate. This takes only a few
minutes a day, and I seldom find anything. On those rare occasions when
I
find a legitimate message, I redirect the message to the original
recipient
address.

We chose this approach because we have nearly 60,000 lists on the
server,
most created by automated processes, rather than as a result of specific
requests from individual list owners, and because it is simply not
feasible
to use per-user quarantine when the recipient domain is a list server.

-- 
Paul Russell, Senior Systems Administrator
OIT Messaging Services Team
University of Notre Dame
[log in to unmask]