Senderbase email volume history too high

[davewill1]

We have an email server that shows large spikes in email volume on sporadic days on senderbase.org.  The spike is typically short lived (1 day).  We have run wireshark logging on the server, sysmon tracing of inbound and outbound email port network connections, checked logs logs and more logs.  Replaced the server with a new server.  The logging and tracing data doesn't jive with what senderbase.org is showing.

Our volume should always show as 0% on senderbase simply because we don't have that much email.  When the spikes occur they hit 2.5 and the reputation goes from neutral to good.

The email server also handles web and ftp traffic.  If there are spikes in web or ftp traffic would that show on senderbase as email volume?  If not what else could explain it?

Thanks for any help or guidance.

[Bob Fayne]

Your reputation goes from neutral to good? Where's the problem?

[davewill1]

The server sends and receives ~200 emails a day on the busiest of busy days.  According to what I have read this wouldn't even qualify as any significant volume to be anything other than Neutral.

However, on this server we see spikes that appear to go way above and beyond (according to what I have read in regards to how the logarithmic rise in the scale occurs).

For a server that sends and receives ~200 emails max to see the attached PNG seems like there is more to learn or investigate.

[Mathew Huynh]

Hello Dave,

I believe the sensors for email volume is only for traffic through email SMTP and should not show FTP or web traffic.

Though this query would be better directed to the team who can retrieve the information directly to assist you with these queries;

http://www.senderbase.org/support/#problem=other

Regards,

Matthew