You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@spamassassin.apache.org by Leonardo Magallon <lm...@itsinc.com> on 2007/06/21 16:47:45 UTC

Spam getting thru

Hi, 
  My server is having a problem with spamd using a lot of resources( spamd
startup script is using -m 5 ) and a lot of spam is getting thru.   The
installation is new using CentOS 5, spamassasin 3.1.8 and I am using
RulesDuJour ( I deleted the blacklist.cf and blacklist related rules to
alleviate load).  

Sometimes the spam doesn't even get the Spam assassin rules as the following
email header shows:

Return-Path: <sa...@silverfour.com>
Delivered-To: myemail@mydomain.com
Received: (qmail 25345 invoked by uid 89); 21 Jun 2007 14:05:02 -0000
Delivered-To: webmaster@mydomain.com
Received: (qmail 25338 invoked by uid 89); 21 Jun 2007 14:05:02 -0000
Received: by simscan 1.3.1 ppid: 24712, pid: 24721, t: 600.9127s
         scanners: attach: 1.3.1 clamav: 0.90.1-exp/m: spam: 3.1.8
Received: from unknown (HELO dxv146.internetdsl.tpnet.pl) (83.14.47.146)
  by www.mydomain.com with SMTP; 21 Jun 2007 13:55:01 -0000
Received-SPF: pass (www.mydomain.com: SPF record at silverfour.com
designates 83.14.47.146 as permitted sender)
Message-ID: <4d...@dxv146.internetdsl.tpnet.pl>
From: "Sales" <sa...@silverfour.com>
To: "Grazini Valentina" <we...@mydomain.com>
Subject: Queens of the Stone Age: Rockin' Rulers
Date: Thu, 21 Jun 2007 13:54:49 +0000
MIME-Version: 1.0
Content-Type: text/plain;
        format=flowed;
        charset="Windows-1252";
        reply-type=original
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2900.2527
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527


Is this behavior correct?

Thanks.

RE: Spam getting thru

Posted by Leonardo Magallon <lm...@itsinc.com>.
Symantec Mail Security replaced Message Body with this text message.  The original text contained prohibited content and was quarantined.

ID:SERVER4::SYQ80c801f5

RE: Spam getting thru

Posted by Leonardo Magallon <lm...@itsinc.com>.
Symantec Mail Security replaced Message Body with this text message.  The original text contained prohibited content and was quarantined.

ID:SERVER4::SYQ7e80bbc7

RE: Spam getting thru

Posted by Leonardo Magallon <lm...@itsinc.com>.
Symantec Mail Security replaced Message Body with this text message.
The original text contained prohibited content and was quarantined.

ID:SERVER4::SYQ7e40e8fe

Re: Spam getting thru

Posted by ram <ra...@netcore.co.in>.
On Thu, 2007-06-21 at 09:47 -0500, Leonardo Magallon wrote:
> Hi, 
>   My server is having a problem with spamd using a lot of resources( spamd
> startup script is using -m 5 ) and a lot of spam is getting thru.   The
> installation is new using CentOS 5, spamassasin 3.1.8 and I am using
> RulesDuJour ( I deleted the blacklist.cf and blacklist related rules to
> alleviate load).  
> 
> Sometimes the spam doesn't even get the Spam assassin rules as the following
> email header shows:
> 
> Return-Path: <sa...@silverfour.com>
> Delivered-To: myemail@mydomain.com
> Received: (qmail 25345 invoked by uid 89); 21 Jun 2007 14:05:02 -0000
> Delivered-To: webmaster@mydomain.com
> Received: (qmail 25338 invoked by uid 89); 21 Jun 2007 14:05:02 -0000
> Received: by simscan 1.3.1 ppid: 24712, pid: 24721, t: 600.9127s
>          scanners: attach: 1.3.1 clamav: 0.90.1-exp/m: spam: 3.1.8
> Received: from unknown (HELO dxv146.internetdsl.tpnet.pl) (83.14.47.146)
>   by www.mydomain.com with SMTP; 21 Jun 2007 13:55:01 -0000
> Received-SPF: pass (www.mydomain.com: SPF record at silverfour.com
> designates 83.14.47.146 as permitted sender)
> Message-ID: <4d...@dxv146.internetdsl.tpnet.pl>
> From: "Sales" <sa...@silverfour.com>
> To: "Grazini Valentina" <we...@mydomain.com>
> Subject: Queens of the Stone Age: Rockin' Rulers
> Date: Thu, 21 Jun 2007 13:54:49 +0000
> MIME-Version: 1.0
> Content-Type: text/plain;
>         format=flowed;
>         charset="Windows-1252";
>         reply-type=original
> Content-Transfer-Encoding: 7bit
> X-Priority: 3
> X-MSMail-Priority: Normal
> X-Mailer: Microsoft Outlook Express 6.00.2900.2527
> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2527
> 
> 
> Is this behavior correct?
> 

I think this should be in the FAQ. Follow the standard recommendations

* Use RBL's at the MTA to reject the mail ( we use zen.spamhaus and
DSBL ) That saves a *LOT* of processing 

* Use a local caching DNS 

* Check valid recipient , valid sender domain etc at the MTA 

* if using SPF do it at the MTA 

* If still it doesnt work get better hardware, Buying 2GB ram is much
cheaper than wasting 2hrs every day trying to deal with load IMHO 



Thanks
Ram

Also when posting to a list do not start off by replying to an unrelated
thread 










> Thanks.