For the last month or so I've noticed a shift in spam content.

Basically still getting a lot of it but there's a new focus on fake jobs offers.

They all look the same, all take to a fake Seek.com payment page.

The main difference though is SpamAssassin on the mail server is Not detecting those as spam (whereas all the usual manhood spam stuff does).

Why do these get not flagged as spam? any tweaks to the server that can help?

link|improve this question

64% accept rate
You could add your own spamassassin filter to flag those seek.com job ad spam messages... – tegbains Jan 21 '11 at 6:28
feedback

1 Answer

up vote 5 down vote accepted

Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam.

I really like SA, but taking a layered approach to e-mail filtering seems to work best these days. My MTAs also check SPF and strictly follow the record.

link|improve this answer
Thanks Chris. Very helpful. – Ben Jan 21 '11 at 23:00
Found this info on setting this up on Plesk for those interested: rackaid.com/resources/… – Ben Jan 21 '11 at 23:01
And this side note is interesting: mattiasgeniar.be/2009/01/14/… – Ben Jan 21 '11 at 23:05
Not meaning to offend the people who wrote that article; but it sounds like they have no business configuring an SMTP server if they're running DNSBL on authenticated SMTP connections. Securing a SMTP server isn't rocket science, and the server should have a default configuration to disable certain checks (spam mainly) for specifically authorized users. I suppose it's something worth being aware of if Plesk has that bug. – Chris S Jan 22 '11 at 3:10
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.