Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

For the last month or so I've noticed a shift in spam content.

Basically still getting a lot of it but there's a new focus on fake jobs offers.

They all look the same, all take to a fake payment page.

The main difference though is SpamAssassin on the mail server is Not detecting those as spam (whereas all the usual manhood spam stuff does).

Why do these get not flagged as spam? any tweaks to the server that can help?

share|improve this question
You could add your own spamassassin filter to flag those job ad spam messages... – tegbains Jan 21 '11 at 6:28
up vote 5 down vote accepted

Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam.

I really like SA, but taking a layered approach to e-mail filtering seems to work best these days. My MTAs also check SPF and strictly follow the record.

share|improve this answer
Thanks Chris. Very helpful. – Ben Jan 21 '11 at 23:00
Found this info on setting this up on Plesk for those interested:… – Ben Jan 21 '11 at 23:01
And this side note is interesting:… – Ben Jan 21 '11 at 23:05
Not meaning to offend the people who wrote that article; but it sounds like they have no business configuring an SMTP server if they're running DNSBL on authenticated SMTP connections. Securing a SMTP server isn't rocket science, and the server should have a default configuration to disable certain checks (spam mainly) for specifically authorized users. I suppose it's something worth being aware of if Plesk has that bug. – Chris S Jan 22 '11 at 3:10

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.