Hot answers tagged

17

I'm looking forward to seeing other answers to this question, but my feeling is that if you're catching compromised mail accounts after only 40 spams have got through, you're doing really well. I'm not sure I could detect similar abuse so quickly, and the prospect worries me. But I'm appalled that seven sets of credentials were stolen in the past week ...


14

Do yourself a favor and set them up with a gateway anti-spam service such as Postini. For a few dollars per mailbox per month, there's absolutely no reason not to and you'll not only eliminate 99% of your spam, you'll also enjoy having access to their spool service (handy for scheduled or unscheduled downtime), not to mention the bandwidth savings by ...


12

I've tried this, and I can strongly recommend that you DON'T DO IT! It seemed like a good idea at the time, but after mail from various senders starting disappearing, I realized that it was a mistake. What I didn't realize was that there are lots of terribly written SMTP servers out there, that don't follow the spec and are fairly bad at handling errors, and ...


10

I use the raw message. There's no need to trim the messages before running sa-learn.


10

Have you checked this parameter: @local_domains_acl It is defined on /etc/amavis/conf.d/05-domain_id. According to the Amavisd-new documentaion on http://www.ijs.si/software/amavisd/: No spam-related headers inserted? Here are some reasons: @local_domains_acl is not correctly set. These headers are only inserted for recipients matching @...


8

Personally, I think you can do something about people spoofing your address; I strongly advocate SPF, with a strong policy on unapproved hosts (-all). I know that not every ISP out there checks SPF on incoming email, but a surprising number do, and spammers are intelligent - since they're picking a forged sender in order to maximise delivery, they'll avoid ...


8

to disable milter processing after amavis, add to your master.cf in the after-amavis section 127.0.0.1:10025 inet n - - - - smtpd [....] -o smtpd_milters= if you want to run the milter after amavis, set the smtpd_milters= configuration option in main.cf to an empty string and add the inet:localhost:8891 configuration to ...


7

We mitigated the same issue by using an outside vendor as our e-mail gateway (in our case, Exchange Online Protection but there's many other comparable services). We then configured all our e-mail sending services to use that as the smarthost. Now, all our outgoing messages are associated with the reputation of the external e-mail gateway. Because of that, ...


7

It seems to me that what your question boils down to is "how many mail servers out there check SPF records on incoming email?". If it's most of them, SRS is an absolute requirement for a forwarding server; if it's none of them, you don't need SRS. Unfortunately, I can't immediately put my hands on any academic work on this. But since I check SPF on ...


6

Well a little patience and it showed up on one of my mailing lists (and now on Apple's KBase: TS3187): Either: 1) Add to /etc/mail/spamassassin.conf score FH_DATE_PAST_20XX 0.0 or 2) Fix the rule in /usr/share/spamassassin/72_active.cf by replacing the FH_DATE_PAST_20XX line with: header FH_DATE_PAST_20XX Date =~ /20[2-9][0-9]/ [if-unset: 2006] ...


6

I've never heard of this method before and I can imagine it would delay legitimate email potentially by several hours. At the end of the day, the smtp protocols need to deliver your legitimate email. The valid servers will hit the bogus mx record and try to deliver to that server... I don't know what you might have running there (if anything), but they will ...


6

Don't get compromised. Seriously. Monitor your traffic. You'll understand what's normal and be able to recognize abnormal traffic. Shut down unnecessary daemons. If the server isn't supposed to send mail, don't run sendmail or postfix. Restrict SSH access and/or assign SSH a non-standard port (e.g. don't use the default port 22). If you need to use port ...


6

It appears that some checks that weren't supposed to be released into all update streams have been. See eg http://unix.stackexchange.com/questions/183763/spamassassin-object-method-location-problems-after-restart for more details, but that the upshot is that the errors should go away following the next update after the errant rule(s) have been pulled. Edit:...


6

SRS seems to be a nice idea on the paper, but doesn't work very well in practice according to the folks of Heinlein Support (they are running a medium sized mail service with over 100000 accounts.) Details are in their talk, though in German, why: https://www.heinlein-support.de/sites/default/files/SPF-DKIM-Greylisting_FrOSCon_2012.pdf The main reason is ...


5

I think you're misunderstanding the way Linux reports memory usage. When a process forks, it results in a second process that shares a lot of resources with the original process. Included in that is memory. However, Linux uses a technique known as Copy On Write (COW) for this. What that means is that each forked child process will see the same data in ...


5

Exchange 2007 offers Message Transport rules to filter messages based on a number of conditions. One of these conditions is the HeaderContains condition which should do what you want. To get it to send the mail to your Junk folder, you could set-up SCL to send messages over a certain threshold to the junk folder, then get the message transport rule to stamp ...


5

You need to provide more detailed logging output to solve that: Stop amavisd and restart it in debug mode (amavisd debug, on Debian/Ubuntu it's probably amavisd-new debug, but since you mention you configured amavisd with amavisd.conf and not /etc/amavis/conf.d/50-user, I guess you are not on Debian/Ubuntu). While you do that, you will probably want to ...


5

Frankly the best way is not to do mass emails from anything remotely related to your domain. By definition anything unsolicited mass emailed is spam. If it's solicited then the recipients will whitelist it.


5

Yes, it's flagging your message because the HTML version apparently contains an image, and the whole e-mail is only 2000 to 2400 bytes (which is pretty small). A piece of spam that contains just an image would appear like this. The "solution" would be to add more words, specifically the e-mail size has to be over 3200 bytes to not be flagged by the set of ...


5

You didn't mention it, so is there a reason you're not using a DNSBL? Edit: SpamAssassin includes support for a few of them - without them, you'll be wasting a lot of CPU cycles analyzing spam.


5

Since I started using using Spamhaus's Zen DNSBL and their DROP list it's cut down the e-mail even getting to SA by 99%. Zen is a combination list of IPs that have been blocked because of known open relays, past spam violations, or their netblock owner has policy-listed them. The DROP list is a list of IPs known to be owned by businesses that send spam. I ...


5

I've gotta agree with John Gardeniers here. Mailcleaner is by far the best opensource spam filtering solution I've found, and I've tested pretty much any that I've been able to locate (mostly those integrated into other firewall-type-linux-distributions). I've used Mailcleaner for several years now to protect my domain (stormnine.net), while using ...


5

Silly me. Just found out about this page: http://www.postfix.org/addon.html ... and I quote: mailscanner system, works with Postfix and other MTAs. WARNING: This software uses unsupported methods to manipulate Postfix queue files directly. This will result in corruption or loss of mail. The mailscanner authors have sofar refused to discuss a proper ...


5

None of them! Use just amavisd-new (with SA, without virus scanner!!) as before-queue-filter. You do it as described here: http://www.postfix.org/SMTPD_PROXY_README.html Even the pros and cons are extensively discussed there. Before you start you should have a look at http://www.postfix.org/POSTSCREEN_README.html to just drop 70% of all Spam before it gets ...


5

Use the GTUBE. The GTUBE (Generic Test for Unsolicited Bulk Email) is a 68-byte test string used to test anti-spam systems, in particular those based on SpamAssassin. In SpamAssassin, it carries an antispam score of 1000 by default, which would be sufficient to trigger any installation. I'd replicate the string here, but... well, I'd rather not. ...


5

First, I'd confirm that "supposedly". ;) Also, I would try sending a small email list from your local computer via SendGrid or Amazon SES. Just to double-confirm it is not your content causing the problem. Review, in detail, Yahoo's postmaster FAQ. And, definitely fill out the Yahoo Bulk Sender form. Just a final thought too - if the lists you're ...


5

With the limited information you provided, NO. But you have individual user preferences and possibly individual Bayes databases that are different? You do know that SpamAssassin adds headers with the rules that were triggered and the resulting spam score e.g. compare a regular message: X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on ... X-Spam-...


5

You should put this options on your /etc/amavis/conf.d/50-user file: $sa_tag_level_deflt = -999; # add spam info headers if at, or above that level $sa_tag2_level_deflt = 6.2; # add 'spam detected' headers at that level $sa_kill_level_deflt = 6.9; # triggers spam evasive actions (e.g. blocks mail) $sa_spam_subject_tag = '**Spam**'; Configure the SPAM ...


4

Thunderbird stores its mail folders as mbox files (see the Thunderbird FAQ). If you locate the file for the spam folder, you can train from it using the --mbox switch: sa-learn --spam --mbox /path/to/spam_mbox


4

Amavisd-new uses SpamAssassin's perl modules directly, so all the spam processing is done directly in the amavisd processes.



Only top voted, non community-wiki answers of a minimum length are eligible