Tag Info

Hot answers tagged

17

I'm looking forward to seeing other answers to this question, but my feeling is that if you're catching compromised mail accounts after only 40 spams have got through, you're doing really well. I'm not sure I could detect similar abuse so quickly, and the prospect worries me. But I'm appalled that seven sets of credentials were stolen in the past week ...


14

Do yourself a favor and set them up with a gateway anti-spam service such as Postini. For a few dollars per mailbox per month, there's absolutely no reason not to and you'll not only eliminate 99% of your spam, you'll also enjoy having access to their spool service (handy for scheduled or unscheduled downtime), not to mention the bandwidth savings by ...


11

I've tried this, and I can strongly recommend that you DON'T DO IT! It seemed like a good idea at the time, but after mail from various senders starting disappearing, I realized that it was a mistake. What I didn't realize was that there are lots of terribly written SMTP servers out there, that don't follow the spec and are fairly retarded about handling ...


10

I use the raw message. There's no need to trim the messages before running sa-learn.


8

Personally, I think you can do something about people spoofing your address; I strongly advocate SPF, with a strong policy on unapproved hosts (-all). I know that not every ISP out there checks SPF on incoming email, but a surprising number do, and spammers are intelligent - since they're picking a forged sender in order to maximise delivery, they'll avoid ...


7

We mitigated the same issue by using an outside vendor as our e-mail gateway (in our case, Exchange Online Protection but there's many other comparable services). We then configured all our e-mail sending services to use that as the smarthost. Now, all our outgoing messages are associated with the reputation of the external e-mail gateway. Because of that, ...


6

Well a little patience and it showed up on one of my mailing lists (and now on Apple's KBase: TS3187): Either: 1) Add to /etc/mail/spamassassin.conf score FH_DATE_PAST_20XX 0.0 or 2) Fix the rule in /usr/share/spamassassin/72_active.cf by replacing the FH_DATE_PAST_20XX line with: header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006] ...


6

I've never heard of this method before and I can imagine it would delay legitimate email potentially by several hours. At the end of the day, the smtp protocols need to deliver your legitimate email. The valid servers will hit the bogus mx record and try to deliver to that server... I don't know what you might have running there (if anything), but they will ...


6

Don't get compromised. Seriously. Monitor your traffic. You'll understand what's normal and be able to recognize abnormal traffic. Shut down unnecessary daemons. If the server isn't supposed to send mail, don't run sendmail or postfix. Restrict SSH access and/or assign SSH a non-standard port (e.g. don't use the default port 22). If you need to use port ...


5

I think you're misunderstanding the way Linux reports memory usage. When a process forks, it results in a second process that shares a lot of resources with the original process. Included in that is memory. However, Linux uses a technique known as Copy On Write (COW) for this. What that means is that each forked child process will see the same data in ...


5

Exchange 2007 offers Message Transport rules to filter messages based on a number of conditions. One of these conditions is the HeaderContains condition which should do what you want. To get it to send the mail to your Junk folder, you could set-up SCL to send messages over a certain threshold to the junk folder, then get the message transport rule to stamp ...


5

Frankly the best way is not to do mass emails from anything remotely related to your domain. By definition anything unsolicited mass emailed is spam. If it's solicited then the recipients will whitelist it.


5

Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam. I ...


5

I've gotta agree with John Gardeniers here. Mailcleaner is by far the best opensource spam filtering solution I've found, and I've tested pretty much any that I've been able to locate (mostly those integrated into other firewall-type-linux-distributions). I've used Mailcleaner for several years now to protect my domain (stormnine.net), while using ...


5

Silly me. Just found out about this page: http://www.postfix.org/addon.html ... and I quote: mailscanner system, works with Postfix and other MTAs. WARNING: This software uses unsupported methods to manipulate Postfix queue files directly. This will result in corruption or loss of mail. The mailscanner authors have sofar refused to discuss a proper ...


5

First, I'd confirm that "supposedly". ;) Also, I would try sending a small email list from your local computer via SendGrid or Amazon SES. Just to double-confirm it is not your content causing the problem. Review, in detail, Yahoo's postmaster FAQ. And, definitely fill out the Yahoo Bulk Sender form. Just a final thought too - if the lists you're ...


5

With the limited information you provided, NO. But you have individual user preferences and possibly individual Bayes databases that are different? You do know that SpamAssassin adds headers with the rules that were triggered and the resulting spam score e.g. compare a regular message: X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on ... ...


4

You could setup another smtp listener process in your master.cf to handle your outgoing mail. Something like the following should get you started with one listening on port 26: 26 inet n - n - 18 smtpd -o header_checks=[your checks] mydestination= relayhost= You may need to tweak that slightly, to disable local ...


4

It calls it up via perl, no deamon required.


4

You need to provide more detailed logging output to solve that: Stop amavisd and restart it in debug mode (amavisd debug, on Debian/Ubuntu it's probably amavisd-new debug, but since you mention you configured amavisd with amavisd.conf and not /etc/amavis/conf.d/50-user, I guess you are not on Debian/Ubuntu). While you do that, you will probably want to ...


4

Your first guess was pretty close :-) I made a bash script to scan a whole maildir against spam #!/bin/bash DIR="/home/vmail/example.net/exampleuser/cur/" for f in $(ls $DIR); do spamassassin -Le "$DIR/$f" > /dev/null ERR=$? echo $ERR if [ $ERR -gt 0 ]; then mv "$DIR/$f" /tmp/spam/ else echo "This was no spam." ...


4

You didn't mention it, so is there a reason you're not using a DNSBL? Edit: SpamAssassin includes support for a few of them - without them, you'll be wasting a lot of CPU cycles analyzing spam.


4

This is not a Postfix bug, but a bad spamc behavior. As of the spamc documentation (see Exit codes) there is no exit code produced when there is an error. And the missing spamd is an error (in my eyes). And because of the Postfix pipe documentation Postfix will treat the exit code 0 as a successful delivery. So you should (as mentioned in the spamc doc) ...


4

Exchange 2010 might allow using the domain/user/mailbox notation for accessing foreign user's mailboxes through IMAP. According to KB937359 this feature was originally removed from Exchange 2007, but re-introduced in SP1 Rollup 4. So it would be worth a try. There is also DavMail which might be of some help - it gateways standard internet mail protocols ...


4

You always need Spam and Ham samples. By only feeding Spam SpamAssassin refuses to activate the bayesian Spam filter. By issuing a spamassassin -D < /path/to/a/complete.mail you can check if bayesian filtering is activated or not (somewhere in the whole debug messages). Hopefully you didn't train SpamAssassin with old Spam (months old). It will only ...


4

to disable milter processing after amavis, add to your master.cf in the after-amavis section 127.0.0.1:10025 inet n - - - - smtpd [....] -o smtpd_milters= if you want to run the milter after amavis, set the smtpd_milters= configuration option in main.cf to an empty string and add the inet:localhost:8891 configuration to ...


3

Thunderbird stores its mail folders as mbox files (see the Thunderbird FAQ). If you locate the file for the spam folder, you can train from it using the --mbox switch: sa-learn --spam --mbox /path/to/spam_mbox


3

The short of it is: it's up to the recipient's site admin as far as what goes and what doesn't. Trying to make it so that it "100% goes through" is an exercise in futulity, because the admin at each site will have different policies on what is "valid". So if you want this to work, follow these simple rules: Always sent to opt-in recipients, with an ...


3

I know it's late, but you are probably best off to use a Commercial Service for this type of E-Mail. They have a wealth of experience, and are usually way better in making sure e-mails get delivered than you can ever be.


3

sa-update is a the bundled program to update the rules, including changing that rule to 2020 and later dates. I have cron set to run it once a month to keep my rules updated.



Only top voted, non community-wiki answers of a minimum length are eligible