My present config is qmail-toaster+spamdyke >Have you implemented a whitelist with all of your vendors? yes i did this, whenever i see a mail is with DENIED_RBL_MATCH bounce, but tracing them through the logs is bit a pain,
> What do you consider to be false positives? @400000004b1df18e1c8961bc.s:@400000004b1d283c1d694a0c spamdyke[23866]: DENIED_RBL_MATCH from: validemai...@pcisecurity_xxxxx.org to: [email protected] origin_ip: 74.53.136.146 origin_rdns: ruby2.fastnix.com auth: (unknown) this particular e-mail will be sent from them to our domain periodically, even though it is not listed in spamhaus, still this email has been denied to mydomain user. at present i wil be sending a mail to the above said emailid stating the mail has got rejected and now the domain is allowed to send mail's , please resend the same to [email protected] but this process is painful, if it is getting delivered to some id's after whitelisting them, i can forward the email to [email protected] and henceforth the mail will not be blocked is there any other way to do the same? spamdyke.conf # cat /etc/spamdyke/spamdyke.conf#dns-blacklist-entry=zombie.dnsbl.sorbs.net#dns-blacklist-entry=dul.dnsbl.sorbs.net#dns-blacklist-entry=bogons.cymru.comdns-blacklist-entry=zen.spamhaus.org#dns-blacklist-entry=bl.spamcop.netgraylist-dir=/var/spamdyke/graylistgraylist-exception-rdns-entry=/etc/spamdyke/graylist-exception-rdns-file#graylist-level=nonegraylist-max-secs=2678400graylist-min-secs=180greeting-delay-secs=5idle-timeout-secs=600ip-blacklist-file=/etc/spamdyke/blacklist_ipip-in-rdns-keyword-blacklist-file=/etc/spamdyke/blacklist_keywordsip-in-rdns-keyword-whitelist-file=/etc/spamdyke/whitelist_keywordsip-whitelist-file=/etc/spamdyke/whitelist_ipaccess-file=/etc/spamdyke/access-filelocal-domains-file=/var/qmail/control/rcpthostslog-level=infolog-target=stderrmax-recipients=50#policy-url=http://my.policy.explanation.url/rdns-blacklist-file=/etc/spamdyke/blacklist_rdnsrdns-whitelist-file=/etc/spamdyke/whitelist_rdnsrecipient-blacklist-file=/etc/spamdyke/blacklist_recipientsrecipient-whitelist-file=/etc/spamdyke/whitelist_recipients#reject-empty-rdns##reject-ip-in-cc-rdns#reject-missing-sender-mx#reject-unresolvable-rdnssender-blacklist-file=/etc/spamdyke/blacklist_senderssender-whitelist-file=/etc/spamdyke/whitelist_senderstls-certificate-file=/var/qmail/control/servercert.pem spamassassin/local.cf # cat /etc/mail/spamassassin/local.cf# These values can be overridden by editing ~/.spamassassin/user_prefs.cf# (see spamassassin(1) for details)# These should be safe assumptions and allow for simple visual sifting# without risking lost emails. ok_locales all#skip_rbl_checks 1 required_score 12report_safe 0#rewrite_header Subject ***SPAM*** use_pyzor 1 use_auto_whitelist 1 use_bayes 1use_bayes_rules 1bayes_auto_learn 1 spamd/current @400000004b1615083b5a5bdc [728] info: spamd: result: . 0 - AWL,BAYES_00,MSGID_MULTIPLE_AT,NO_RELAYS scantime=9.7,size=3414,user=vpopmail,uid=508,required_score=12.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=47811,mid=<011301ca731f$d59bfa30$80d3ee...@[email protected]>,bayes=0.000000,autolearn...@400000004b16150e2e2bec64 [320] info: spamd: result: . 0 - AWL,BAYES_00,MSGID_MULTIPLE_AT,NO_RELAYS scantime=7.9,size=3414,user=vpopmail,uid=508,required_score=12.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=47814,mid=<011301ca731f$d59bfa30$80d3ee...@[email protected]>,bayes=0.000000,autolearn=no > Also, look to see which rules are contributing to your false positives. > > Some rules may be inappropriate in your environment, causing some emails > to > score too high. spamdyke rules or spamassassin rules? spamassassin/local.pre # cat local.preloadplugin Mail::SpamAssassin::Plugin::URIDNSBL v310.pre loadplugin Mail::SpamAssassin::Plugin::Pyzorloadplugin Mail::SpamAssassin::Plugin::AWLloadplugin Mail::SpamAssassin::Plugin::WhiteListSubjectloadplugin Mail::SpamAssassin::Plugin::DomainKeysloadplugin Mail::SpamAssassin::Plugin::MIMEHeaderloadplugin Mail::SpamAssassin::Plugin::ReplaceTags cat v320.pre loadplugin Mail::SpamAssassin::Plugin::Checkloadplugin Mail::SpamAssassin::Plugin::HTTPSMismatchloadplugin Mail::SpamAssassin::Plugin::URIDetail loadplugin Mail::SpamAssassin::Plugin::Bayesloadplugin Mail::SpamAssassin::Plugin::BodyEvalloadplugin Mail::SpamAssassin::Plugin::DNSEvalloadplugin Mail::SpamAssassin::Plugin::HTMLEvalloadplugin Mail::SpamAssassin::Plugin::HeaderEvalloadplugin Mail::SpamAssassin::Plugin::MIMEEvalloadplugin Mail::SpamAssassin::Plugin::RelayEvalloadplugin Mail::SpamAssassin::Plugin::URIEvalloadplugin Mail::SpamAssassin::Plugin::WLBLEval loadplugin Mail::SpamAssassin::Plugin::VBounce loadplugin Mail::SpamAssassin::Plugin::ImageInfo > To: [email protected] > From: [email protected] > Date: Thu, 10 Dec 2009 11:00:48 -0700 > Subject: [qmailtoaster] Re: Fine tuning qmail+spamdyke > > nicole thomson wrote: > > Thanks Eric 'shubes' > > > > Now most of the spam messages are getting blocking, along with that many > > false positives too, sometimes it is tiresome. Is there any good > > suggestions please? > > > > -Nic > > What is your present configuration? Are you still running spamdyke? If > so, what's in your spamdyke.conf file? > > Have you implemented a whitelist with all of your vendors? > > What do you consider to be false positives? > > You might need to adjust the spamassassin thresholds to suite your > environment. Look at the scores of the false positives. If they're > slightly above the required_score in your local.cf file, you can adjust > that setting appropriately. > > Also, look to see which rules are contributing to your false positives. > Some rules may be inappropriate in your environment, causing some emails > to score too high. > > Adjusting a server to handle spam well is something that takes some > doing, but it isn't all that difficult. Once you have things set up for > your environment, things will run smoothly with most spam being caught, > and very few false positives. > > -- > -Eric 'shubes' > > > --------------------------------------------------------------------------------- > Qmailtoaster is sponsored by Vickers Consulting Group > (www.vickersconsulting.com) > Vickers Consulting Group offers Qmailtoaster support and installations. > If you need professional help with your setup, contact them today! > --------------------------------------------------------------------------------- > Please visit qmailtoaster.com for the latest news, updates, and packages. > > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > _________________________________________________________________ New Windows 7: Find the right PC for you. Learn more. http://windows.microsoft.com/shop
