Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For the last month or so I've noticed a shift in spam content.

Basically still getting a lot of it but there's a new focus on fake jobs offers.

They all look the same, all take to a fake Seek.com payment page.

The main difference though is SpamAssassin on the mail server is Not detecting those as spam (whereas all the usual manhood spam stuff does).

Why do these get not flagged as spam? any tweaks to the server that can help?

share|improve this question
    
You could add your own spamassassin filter to flag those seek.com job ad spam messages... –  tegbains Jan 21 '11 at 6:28

1 Answer 1

up vote 5 down vote accepted

Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam.

I really like SA, but taking a layered approach to e-mail filtering seems to work best these days. My MTAs also check SPF and strictly follow the record.

share|improve this answer
    
Thanks Chris. Very helpful. –  Ben Jan 21 '11 at 23:00
    
Found this info on setting this up on Plesk for those interested: rackaid.com/resources/… –  Ben Jan 21 '11 at 23:01
    
And this side note is interesting: mattiasgeniar.be/2009/01/14/… –  Ben Jan 21 '11 at 23:05
    
Not meaning to offend the people who wrote that article; but it sounds like they have no business configuring an SMTP server if they're running DNSBL on authenticated SMTP connections. Securing a SMTP server isn't rocket science, and the server should have a default configuration to disable certain checks (spam mainly) for specifically authorized users. I suppose it's something worth being aware of if Plesk has that bug. –  Chris S Jan 22 '11 at 3:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.