You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Christian Motta <ch...@agweb.net> on 2004/04/28 23:32:43 UTC
SA is great but i need more
The amount of spam as been increasing at an alarming rate. If it keeps
going like this it is going to start affecting bandwidth/overhead of my
network. About 85% of all email coming into my network is spam.
SA is doing a great job of catching spam but it does it after I have
received the email thus the resources issue.
Does anyone recommend a tweek/milter. for sendmail to reject spam before
it gets to my box? Nothing to extreme, but something that would at
least cut down on the most egregious spams getting to my box.
I have users who forward email to aol and aol somehow doesn't accept
spam and it ends up back in email box, being the administrator, because
my box can't send it back to the original sender. I am not sure how they
do it but it looks like it might validate the headers some how, dns
checking maybe.
Any information appreciated.
Chris
Chris at agweb.net
Re: SA is great but i need more
Posted by Jeff Chan <je...@surbl.org>.
On Wednesday, April 28, 2004, 3:06:10 PM, John Hardin wrote:
> I strongly suggest you employ a set of DNSRBLs to reject mail clients
> very early in the SMTP phase. There are DNSRBLs that are highly trusted
> (e.g. the SpamHaus list), ones for zombies and such
Agreed. The trick is to know which ones are trustworthy,
fit your needs, etc.
> Does anybody have a comprehensive list of the DNSRBLs?
There's a fairly long list in the reports at:
http://www.sdsc.edu/~jeff/spam/Blacklists_Compared.html
Jeff C.
--
Jeff Chan
mailto:jeffc@surbl.org
http://www.surbl.org/
Re: SA is great but i need more
Posted by Fred <sp...@freddyt.com>.
John Hardin wrote:
> Does anybody have a comprehensive list of the DNSRBLs?
http://wiki.apache.org/spamassassin/DnsBlocklists
http://www.declude.com/junkmail/support/ip4r.htm
RE: SA is great but i need more
Posted by Todd Schuldt <ts...@ised.org>.
Go to http://www.dnsstuff.com and look up your IP, it will check over 150
DNSRBLs - that comprehensive enough? =)
Section:
Spam database lookup Enter IP (or host name)?
See if a mail server is listed in 150+ spam databases
> -----Original Message-----
> From: John Hardin [mailto:johnh@aproposretail.com]
> Sent: Wednesday, April 28, 2004 5:06 PM
> To: SpamAssassin list
> Subject: Re: SA is great but i need more
>
> Does anybody have a comprehensive list of the DNSRBLs?
Re: SA is great but i need more
Posted by John Hardin <jo...@aproposretail.com>.
On Wed, 2004-04-28 at 14:32, Christian Motta wrote:
> SA is doing a great job of catching spam but it does it after I have
> received the email thus the resources issue.
I strongly suggest you employ a set of DNSRBLs to reject mail clients
very early in the SMTP phase. There are DNSRBLs that are highly trusted
(e.g. the SpamHaus list), ones for zombies and such, ones for
geographical areas (good if you have no reason to accept mail from, say,
china), and DNSRBLs of varying levels of aggressiveness and tolerance
for spam-friendly ISPs.
Does anybody have a comprehensive list of the DNSRBLs?
--
John Hardin KA7OHZ
Internal Systems Administrator/Guru voice: (425) 672-1304
Apropos Retail Management Systems, Inc. fax: (425) 672-0192
-----------------------------------------------------------------------
If you smash a computer to bits with a mallet, that appears to count
as encryption in the state of Nevada.
- CRYPTO-GRAM 12/2001
-----------------------------------------------------------------------
Re: SA is great but i need more
Posted by Henry Leparskas <hl...@uwo.ca>.
> > Chris
You had a list of many SORBS zones. Does the aggregate zone contain all of the
individual zone information?
Re: SA is great but i need more
Posted by Martin Hepworth <ma...@solid-state-logic.com>.
Christian
have you considered building an email gateway box that does the
SA/Anti-virus etc stuff. That way the email box doesn't get deluged with
email (unless you want to merely tag suspect spam).
I use MailScanner to wrap up the MTA, SA, Sophos, ClamAV pieces into a
single entity for an email gateway. Amavis-New is an alternative...
I'd say about the same %age of email is malware/spam on my network too,
if thats any consolation.
--
Martin Hepworth
Snr Systems Administrator
Solid State Logic
Tel: +44 (0)1865 842300
Christian Motta wrote:
> The amount of spam as been increasing at an alarming rate. If it keeps
> going like this it is going to start affecting bandwidth/overhead of my
> network. About 85% of all email coming into my network is spam.
>
>
>
> SA is doing a great job of catching spam but it does it after I have
> received the email thus the resources issue.
>
>
>
> Does anyone recommend a tweek/milter… for sendmail to reject spam before
> it gets to my box? Nothing to extreme, but something that would at
> least cut down on the most egregious spams getting to my box.
>
>
>
> I have users who forward email to aol and aol somehow doesn’t accept
> spam and it ends up back in email box, being the administrator, because
> my box can’t send it back to the original sender. I am not sure how they
> do it but it looks like it might validate the headers some how, dns
> checking maybe.
>
>
>
> Any information appreciated.
>
>
>
> Chris
>
> Chris at agweb.net
>
**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.
This footnote confirms that this email message has been swept
for the presence of computer viruses and is believed to be clean.
**********************************************************************
Re: SA is great but i need more
Posted by Justin <li...@numbnuts.net>.
On Wed, 28 Apr 2004, Christian Motta wrote:
> SA is doing a great job of catching spam but it does it after I have
> received the email thus the resources issue.
>
> Does anyone recommend a tweek/milter. for sendmail to reject spam before
> it gets to my box? Nothing to extreme, but something that would at
> least cut down on the most egregious spams getting to my box.
Yes. MIMEDefang. I can't say enough good things about it. If you're a
Perl buff you can make it do anything you can imagine. We just bought
it's commercial big brother called CanIt Pro. It's commercial but not
canned, mind you (you still have all the source and can hack it up to your
heart's content). MD is a great tool. The folks at Roaring Penguin are
great too.
www.mimedefang.org
Justin
Re: SA is great but i need more
Posted by Matt Kettler <mk...@comcast.net>.
At 02:32 PM 4/28/04 -0700, Christian Motta wrote:
>The amount of spam as been increasing at an alarming rate. If it keeps
>going like this it is going to start affecting bandwidth/overhead of my
>network. About 85% of all email coming into my network is spam.
>
>SA is doing a great job of catching spam but it does it after I have
>received the email thus the resources issue.
>
>
>Does anyone recommend a tweek/milter& for sendmail to reject spam before
>it gets to my box? Nothing to extreme, but something that would at least
>cut down on the most egregious spams getting to my box.
Mimedefang springs to mind.
>I have users who forward email to aol and aol somehow doesnt accept spam
>and it ends up back in email box, being the administrator, because my box
>cant send it back to the original sender. I am not sure how they do it but
>it looks like it might validate the headers some how, dns checking maybe.
You can't send email to AOL because your mailserver lacks a reverse DNS
entry. AOL only accepts mail from servers with a RDNS entry. If you can,
you should fix that. It's becoming increasingly common to do so.
See, when you dropped mail off at apache, no RDNS:
Received: from unknown (HELO slackfish.com) (64.113.193.150)
by daedalus.apache.org with SMTP; 28 Apr 2004 21:30:52 -0000
Although I just tested it right now, it appears to work, so maybe you've
already fixed that.
Host name: bass.slackfish.com
IP address: 64.113.193.150
Alias(es): 150.193.113.64.in-addr.arpa