You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Tom Robinson <to...@motec.com.au> on 2015/09/28 05:02:23 UTC
SPAM from our own domain
Hi,
We're receiving quite a few SPAM messages with zip files attached that look like they come from our
own domain. Sorry if I appear a complete noob, but how is this even possible? SA seems to not score
this high enough to be SPAM. What can we do to fix this? Headers are below.
Kind regards,
Tom
From tenayad@qka.com Thu Sep 24 13: 29:50 2015
MIME-Version: 1.0
X-Spam-Status: No, hits=2.8 required=5.0
X-MS-Exchange-Organization-Authsource: GA8R9NL0J6U7K0R@motec.com.au
Content-Type: multipart/mixed; boundary="----=_Next_54920_1367254513.7341918864818"
Message-ID: <3Q...@motec.com.au>
X-MS-Exchange-Organization-Authas: Internal
X-MS-Exchange-Organization-SCL: -1
X-MS-Tnef-Correlator: <J0...@motec.com.au>
Received: from mail.motec.com.au (motec6.motec.com.au [115.70.189.243]) by support.motec.com.au
(8.14.4/8.14.4) with ESMTP id t8O3Tn7D021736 for <i2...@support.motec.com.au>; Thu, 24 Sep 2015
13:29:50 +1000
Received: (qmail 8515 invoked by alias); 24 Sep 2015 03:29:48 -0000
Received: (qmail 8502 invoked by uid 187); 24 Sep 2015 03:29:48 -0000
Received: from 116.58.205.184 by scion.motec.com.au (envelope-from <te...@qka.com>, uid 181)
with qmail-scanner-2.08st (clamdscan: 0.97.8/20932. spamassassin: 3.3.1. perlscan: 2.08st.
Clear:RC:0(116.58.205.184):SA:0(2.8/5.0):. Processed in 6.943055 secs); 24 Sep 2015 03:29:48 -0000
Received: from unknown (HELO banglalinkgsm.com) (116.58.205.184) by scion.motec.com.au with SMTP;
24 Sep 2015 03:29:29 -0000
Received: from 4750.motec.com.au (10.238.114.77) by motec.com.au (10.0.0.218) with Microsoft SMTP
Server id 6WSFFOKZ; Wed, 23 Sep 2015 11:28:46 GMT
Delivered-To: i2dev@motec.com.au
Subject: Scanned Image from a Xerox WorkCentre
X-Spam-Report: SA TESTS 1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT [116.58.205.184 listed
in bb.barracudacentral.org] 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date 0.0
SPF_HELO_FAIL SPF: HELO does not match SPF record (fail) [SPF failed: Please see
http://www.openspf.org/Why?s=helo;id=banglalinkgsm.com;ip=116.58.205.184;r=scion.motec.com.au] -1.9
BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.8 RDNS_NONE Delivered to internal
network by a host with no rDNS 1.0 XPRIO Has X-Priority header 0.4 AWL AWL: Adjusted score from AWL
reputation of From: address
X-Priority: 3 (Normal)
Date: Wed, 23 Sep 2015 11:28:46 GMT
X-Spam-Level: ++
X-MS-Has-Attach: yes
X-MS-Exchange-Organization-Authmechanism: 02
To: helen.papponp@motec.com.au
X-MS-Exchange-Organization-Avstamp-Mailbox: MSFTFF;0;0;0 0 0
From: "Incoming Fax" <In...@motec.com.au>
Content-Length: 0
content-type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
X-RT-Original-Encoding: ascii
Content-Length: 412
--
Tom Robinson
IT Manager/System Administrator
MoTeC Pty Ltd
121 Merrindale Drive
Croydon South
3136 Victoria
Australia
T: +61 3 9761 5050
F: +61 3 9761 5051
E: tom.robinson@motec.com.au
Re: SPAM from our own domain
Posted by Benny Pedersen <me...@junc.eu>.
Tom Robinson skrev den 2015-09-28 07:17:
> Hi Benny,
>
> thanks for your email.
>
> On 28/09/15 13:29, Benny Pedersen wrote:
>> Tom Robinson skrev den 2015-09-28 05:02:
>>
>>> From tenayad@qka.com Thu Sep 24 13: 29:50 2015
>>
>> is this the envelope sender domain ?
>
> I believe so. How can I be sure?
grep -i tenayad@qka.com /var/log/syslogfile-for-your-linux-distro
>>> From: "Incoming Fax" <In...@motec.com.au>
>>
>> is this unsigned dkim domain ?
>>
> Sorry to be a noob. What do you mean here?
https://www.digitalocean.com/community/tutorials/how-to-install-and-configure-dkim-with-postfix-on-debian-wheezy
http://serverfault.com/questions/695254/opendkim-milter-with-postfix
i assume you use postfix, but if you use milters it should not matter
what mta you use opendkim with
>> begin setup spf and dkim signing
> We have a TXT record in DNS for spf. I'm not sure what to do with DKIM.
this a begin, in that case the forged domain sender could be rejected in
mta if forged
>> use pypolicyd-spf in mta stage
>
> Is that package going to work with qmail? If it does work with qmail,
> will it install on CentOS 5?
dont know, i use gentoo here
Re: SPAM from our own domain
Posted by Christian Jaeger <ch...@christianjaeger.ch>.
I've noticed Haraka (and I've used software by Matt Sergeant before,
AxKit and qpsmtpd). I'm using qpsmtpd as the SMTP daemon already
(that's how you do spam filtering in a Qmail setup, and qmail is the
original delivery backend for qpsmtpd), which has the same
architecture as Haraka (single process, event based, plugins). I
haven't tried it, so I wouldn't know, but I'm still surprised that you
suggest it is similar(?) to Qmail. It hasn't triggered my interest so
far; I don't need raw speed for my purposes, and if I add a tool in
another programming language then I might wait for a replacement in a
language that allows for static verification (like Rust, Haskell,
Ocaml) or has a process model built in (Erlang/Elixir); I know some
MTAs already exist in those languages, although perhaps not stable or
complete enough for me right now.
Perhaps let's stop or move this discussion elsewhere now as it's
probably OT. I wanted to offer Tom my help, I didn't ask for help
about MTAs here.
Christian.
Re: SPAM from our own domain
Posted by Axb <ax...@gmail.com>.
On 10/01/2015 11:50 AM, Christian Jaeger wrote:
> I don't have any problems with Qmail. I can code when needed for the
> missing parts. The unsolved problems I have with my mail setup would
> not be solved by going with another MTA. I like and know Qmail's
> configuration, modularity and security track record. This way my time
> is spent learning how things work, as opposed to how to use another
> MTA.
although also offtopic <aplologize>
You may want to look into Haraka which is pretty much a *modern*
replacement for Qmail/Qpsmtpd
https://haraka.github.io/about.html
hard to beat its performance/features and modularity
Re: SPAM from our own domain
Posted by Christian Jaeger <ch...@christianjaeger.ch>.
I don't have any problems with Qmail. I can code when needed for the missing parts. The unsolved problems I have with my mail setup would not be solved by going with another MTA. I like and know Qmail's configuration, modularity and security track record. This way my time is spent learning how things work, as opposed to how to use another MTA.
Ch.
Re: SPAM from our own domain
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 30.09.15 03:03, Christian Jaeger wrote:
>You write that you're using Qmail. If you'd like to implement DKIM
>signing for your outgoing mail (for possibly better deliverability and
>also so that you could verify incoming mail and be sure that it's not
>your own by verifying the DKIM signature), then perhaps you're
>interested in what I've worked on: I didn't want to patch Qmail for
>DKIM support, so I took an existing, older script that works as a
>wrapper for qmail-remote and improved it. It can now also add hashcash
>stamps (which may or may not actually be useful, but in any case
>doesn't hurt me since I've got plenty CPU time for it), and checks
>whether the mail to be sent is a bounce for a likely spam, in which
>case it diverts it locally to avoid sending backscatter. This has only
>been tested by me so far, so YMMV.. tell me if you run into problems.
>
>https://github.com/pflanze/better-qmail-remote
>
>I've just made a release v0.1, you can verify its signature with `git tag -v v0_1` using the key:
>
>http://christianjaeger.ch/pgpkey-A54A-1D7C-A1F9-4C86-6AC8--1A1F-0FA5-B211-04ED-B072.asc
I wonder if there's really a sane reason to use the old qmail
- last release was made 17 years ago...
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
10 GOTO 10 : REM (C) Bill Gates 1998, All Rights Reserved!
Re: SPAM from our own domain
Posted by Christian Jaeger <ch...@christianjaeger.ch>.
Hi Tom,
You write that you're using Qmail. If you'd like to implement DKIM
signing for your outgoing mail (for possibly better deliverability and
also so that you could verify incoming mail and be sure that it's not
your own by verifying the DKIM signature), then perhaps you're
interested in what I've worked on: I didn't want to patch Qmail for
DKIM support, so I took an existing, older script that works as a
wrapper for qmail-remote and improved it. It can now also add hashcash
stamps (which may or may not actually be useful, but in any case
doesn't hurt me since I've got plenty CPU time for it), and checks
whether the mail to be sent is a bounce for a likely spam, in which
case it diverts it locally to avoid sending backscatter. This has only
been tested by me so far, so YMMV.. tell me if you run into problems.
https://github.com/pflanze/better-qmail-remote
I've just made a release v0.1, you can verify its signature with `git tag -v v0_1` using the key:
http://christianjaeger.ch/pgpkey-A54A-1D7C-A1F9-4C86-6AC8--1A1F-0FA5-B211-04ED-B072.asc
Cheers,
Christian.
Re: SPAM from our own domain
Posted by Tom Robinson <to...@motec.com.au>.
Hi Benny,
thanks for your email.
On 28/09/15 13:29, Benny Pedersen wrote:
> Tom Robinson skrev den 2015-09-28 05:02:
>
>> From tenayad@qka.com Thu Sep 24 13: 29:50 2015
>
> is this the envelope sender domain ?
I believe so. How can I be sure?
>
>> From: "Incoming Fax" <In...@motec.com.au>
>
> is this unsigned dkim domain ?
>
Sorry to be a noob. What do you mean here?
>
> begin setup spf and dkim signing
We have a TXT record in DNS for spf. I'm not sure what to do with DKIM.
>
> use pypolicyd-spf in mta stage
Is that package going to work with qmail? If it does work with qmail, will it install on CentOS 5?
Kind regards,
Tom
Re: SPAM from our own domain
Posted by Benny Pedersen <me...@junc.eu>.
Tom Robinson skrev den 2015-09-28 05:02:
> From tenayad@qka.com Thu Sep 24 13: 29:50 2015
is this the envelope sender domain ?
> From: "Incoming Fax" <In...@motec.com.au>
is this unsigned dkim domain ?
begin setup spf and dkim signing
use pypolicyd-spf in mta stage
Re: SPAM from our own domain
Posted by Matus UHLAR - fantomas <uh...@fantomas.sk>.
On 28.09.15 13:02, Tom Robinson wrote:
>We're receiving quite a few SPAM messages with zip files attached that look like they come from our
>own domain. Sorry if I appear a complete noob, but how is this even possible? SA seems to not score
>this high enough to be SPAM. What can we do to fix this? Headers are below.
>From tenayad@qka.com Thu Sep 24 13: 29:50 2015
>Subject: Scanned Image from a Xerox WorkCentre
>X-Spam-Report: SA TESTS 1.4 RCVD_IN_BRBL_LASTEXT RBL: RCVD_IN_BRBL_LASTEXT [116.58.205.184 listed
>in bb.barracudacentral.org] 1.0 DATE_IN_PAST_12_24 Date: is 12 to 24 hours before Received: date 0.0
>SPF_HELO_FAIL SPF: HELO does not match SPF record (fail) [SPF failed: Please see
>http://www.openspf.org/Why?s=helo;id=banglalinkgsm.com;ip=116.58.205.184;r=scion.motec.com.au] -1.9
>BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] 0.8 RDNS_NONE Delivered to internal
^^^^^^^^
this is the main problem, otherwise the other rules would cause the mail to
hit SPAM. you need to train more misclassified spam probably
>network by a host with no rDNS 1.0 XPRIO Has X-Priority header 0.4 AWL AWL: Adjusted score from AWL
>reputation of From: address
>Date: Wed, 23 Sep 2015 11:28:46 GMT
>To: helen.papponp@motec.com.au
>From: "Incoming Fax" <In...@motec.com.au>
--
Matus UHLAR - fantomas, uhlar@fantomas.sk ; http://www.fantomas.sk/
Warning: I wish NOT to receive e-mail advertising to this address.
Varovanie: na tuto adresu chcem NEDOSTAVAT akukolvek reklamnu postu.
The 3 biggets disasters: Hiroshima 45, Tschernobyl 86, Windows 95