Am 26.10.2014 um 14:25 schrieb Stephen Satchell:
What will I keep: * To: fields that are nonsense * From: fields like FBI, CIA, IRS, [email protected], my PTR * Subjects: excessive spaces, ESC. certain keywords, phrases * Subject: still popular with web-form abusers * Certain checks that block web-form abuse effectively For what it's worth, my daily log-check shows that PostFix is blocking a moderate number of mail messages via SpamHaus, but header_check blocking has dropped considerably. How effective has this process been? For the past four days, I've had five (5) spam messages. Before I started aggressively blocking mail-abuse subnets, I was getting about 150 per day
forget about single RBL's, they are on one hand very error-prone and only catch a part - instead implement postscreen with a reasonable scoring and you drop around 90-95% of all junk
with the config below you reject if the summary is 8 or higher, have some whitelists in the mix and the greet-action alone blocks a noticeable part of junk, postscreen_greet_wait enforces a wait delay for new clients and maybe over the time you are no longer attractive as target
http://www.postfix.org/POSTSCREEN_README.html postscreen_dnsbl_ttl = 10m postscreen_dnsbl_threshold = 8 postscreen_dnsbl_action = enforce postscreen_greet_action = enforce postscreen_greet_wait = ${stress?3}${stress:10}s postscreen_dnsbl_sites = dnsbl.sorbs.net=127.0.0.10*8 zen.spamhaus.org=127.0.0.[10;11]*8 b.barracudacentral.org=127.0.0.2*7 dnsbl.inps.de=127.0.0.2*7 dnsbl.sorbs.net=127.0.0.5*6 zen.spamhaus.org=127.0.0.[4..7]*6 bl.mailspike.net=127.0.0.[2;10;11;12]*4 bl.spamcop.net=127.0.0.2*4 bl.spameatingmonkey.net=127.0.0.[2;3]*4 zen.spamhaus.org=127.0.0.3*4 dnsrbl.swinog.ch=127.0.0.3*4 dnsbl-1.uceprotect.net=127.0.0.2*3 ix.dnsbl.manitu.net=127.0.0.2*3 psbl.surriel.com=127.0.0.2*3 zen.spamhaus.org=127.0.0.2*3 dnsbl.sorbs.net=127.0.0.7*3 dnsbl.sorbs.net=127.0.0.8*2 dnsbl-2.uceprotect.net=127.0.0.2*2 dnsbl.sorbs.net=127.0.0.6*2 dnsbl.sorbs.net=127.0.0.9*2 dnsbl-backscatterer.thelounge.net=127.0.0.2*1 wl.mailspike.net=127.0.0.[18;19;20]*-2 ips.whitelisted.org=127.0.0.2*-2 list.dnswl.org=127.0.[0..255].0*-2 list.dnswl.org=127.0.[0..255].1*-3 list.dnswl.org=127.0.[0..255].2*-4 list.dnswl.org=127.0.[0..255].3*-5
