also in smtp/current i could see lots of TIMEOUT @400000004b21e0ca03ac29a4 spamdyke[29507]: TIMEOUT from: [email protected] to: [email protected] origin_ip: 78.129.199.225 origin_rdns: mail1.arrowmail.co.uk auth: (unknown) reason: TIMEOUT
@400000004b1df18e1c8961bc.s:@400000004b1d283c1d694a0c spamdyke[23866]: DENIED_RBL_MATCH from: validemai...@pcisecurity_xxxxx.org to: [email protected] origin_ip: 74.53.136.146 origin_rdns: ruby2.fastnix.com auth: (unknown) spamhaus lookup as followsIP Address Lookup 74.53.136.146 is not listed in the SBL 74.53.136.146 is not listed in the PBL 74.53.136.146 is not listed in the XBL Similar to this many mails were getting bounced, even if it is a business enquiry with valid contents and without listing in spamhaus From: [email protected] To: [email protected] Date: Fri, 11 Dec 2009 12:44:50 +0530 Subject: RE: [qmailtoaster] Re: Fine tuning qmail+spamdyke My present config is qmail-toaster+spamdyke >Have you implemented a whitelist with all of your vendors? yes i did this, whenever i see a mail is with DENIED_RBL_MATCH bounce, but tracing them through the logs is bit a pain, > What do you consider to be false positives? @400000004b1df18e1c8961bc.s:@400000004b1d283c1d694a0c spamdyke[23866]: DENIED_RBL_MATCH from: validemai...@pcisecurity_xxxxx.org to: [email protected] origin_ip: 74.53.136.146 origin_rdns: ruby2.fastnix.com auth: (unknown) this particular e-mail will be sent from them to our domain periodically, even though it is not listed in spamhaus, still this email has been denied to mydomain user. at present i wil be sending a mail to the above said emailid stating the mail has got rejected and now the domain is allowed to send mail's , please resend the same to [email protected] but this process is painful, if it is getting delivered to some id's after whitelisting them, i can forward the email to [email protected] and henceforth the mail will not be blocked is there any other way to do the same? spamdyke.conf # cat /etc/spamdyke/spamdyke.conf#dns-blacklist-entry=zombie.dnsbl.sorbs.net#dns-blacklist-entry=dul.dnsbl.sorbs.net#dns-blacklist-entry=bogons.cymru.comdns-blacklist-entry=zen.spamhaus.org#dns-blacklist-entry=bl.spamcop.netgraylist-dir=/var/spamdyke/graylistgraylist-exception-rdns-entry=/etc/spamdyke/graylist-exception-rdns-file#graylist-level=nonegraylist-max-secs=2678400graylist-min-secs=180greeting-delay-secs=5idle-timeout-secs=600ip-blacklist-file=/etc/spamdyke/blacklist_ipip-in-rdns-keyword-blacklist-file=/etc/spamdyke/blacklist_keywordsip-in-rdns-keyword-whitelist-file=/etc/spamdyke/whitelist_keywordsip-whitelist-file=/etc/spamdyke/whitelist_ipaccess-file=/etc/spamdyke/access-filelocal-domains-file=/var/qmail/control/rcpthostslog-level=infolog-target=stderrmax-recipients=50#policy-url=http://my.policy.explanation.url/rdns-blacklist-file=/etc/spamdyke/blacklist_rdnsrdns-whitelist-file=/etc/spamdyke/whitelist_rdnsrecipient-blacklist-file=/etc/spamdyke/blacklist_recipientsrecipient-whitelist-file=/etc/spamdyke/whitelist_recipients#reject-empty-rdns##reject-ip-in-cc-rdns#reject-missing-sender-mx#reject-unresolvable-rdnssender-blacklist-file=/etc/spamdyke/blacklist_senderssender-whitelist-file=/etc/spamdyke/whitelist_senderstls-certificate-file=/var/qmail/control/servercert.pem spamassassin/local.cf # cat /etc/mail/spamassassin/local.cf# These values can be overridden by editing ~/.spamassassin/user_prefs.cf# (see spamassassin(1) for details)# These should be safe assumptions and allow for simple visual sifting# without risking lost emails. ok_locales all#skip_rbl_checks 1 required_score 12report_safe 0#rewrite_header Subject ***SPAM*** use_pyzor 1 use_auto_whitelist 1 use_bayes 1use_bayes_rules 1bayes_auto_learn 1 spamd/current @400000004b1615083b5a5bdc [728] info: spamd: result: . 0 - AWL,BAYES_00,MSGID_MULTIPLE_AT,NO_RELAYS scantime=9.7,size=3414,user=vpopmail,uid=508,required_score=12.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=47811,mid=<011301ca731f$d59bfa30$80d3ee...@[email protected]>,bayes=0.000000,autolearn...@400000004b16150e2e2bec64 [320] info: spamd: result: . 0 - AWL,BAYES_00,MSGID_MULTIPLE_AT,NO_RELAYS scantime=7.9,size=3414,user=vpopmail,uid=508,required_score=12.0,rhost=localhost.localdomain,raddr=127.0.0.1,rport=47814,mid=<011301ca731f$d59bfa30$80d3ee...@[email protected]>,bayes=0.000000,autolearn=no > Also, look to see which rules are contributing to your false positives. > > Some rules may be inappropriate in your environment, causing some emails > to > score too high. spamdyke rules or spamassassin rules? spamassassin/local.pre # cat local.preloadplugin Mail::SpamAssassin::Plugin::URIDNSBL v310.pre loadplugin Mail::SpamAssassin::Plugin::Pyzorloadplugin Mail::SpamAssassin::Plugin::AWLloadplugin Mail::SpamAssassin::Plugin::WhiteListSubjectloadplugin Mail::SpamAssassin::Plugin::DomainKeysloadplugin Mail::SpamAssassin::Plugin::MIMEHeaderloadplugin Mail::SpamAssassin::Plugin::ReplaceTags cat v320.pre loadplugin Mail::SpamAssassin::Plugin::Checkloadplugin Mail::SpamAssassin::Plugin::HTTPSMismatchloadplugin Mail::SpamAssassin::Plugin::URIDetail loadplugin Mail::SpamAssassin::Plugin::Bayesloadplugin Mail::SpamAssassin::Plugin::BodyEvalloadplugin Mail::SpamAssassin::Plugin::DNSEvalloadplugin Mail::SpamAssassin::Plugin::HTMLEvalloadplugin Mail::SpamAssassin::Plugin::HeaderEvalloadplugin Mail::SpamAssassin::Plugin::MIMEEvalloadplugin Mail::SpamAssassin::Plugin::RelayEvalloadplugin Mail::SpamAssassin::Plugin::URIEvalloadplugin Mail::SpamAssassin::Plugin::WLBLEval loadplugin Mail::SpamAssassin::Plugin::VBounce loadplugin Mail::SpamAssassin::Plugin::ImageInfo > To: [email protected] > From: [email protected] > Date: Thu, 10 Dec 2009 11:00:48 -0700 > Subject: [qmailtoaster] Re: Fine tuning qmail+spamdyke > > nicole thomson wrote: > > Thanks Eric 'shubes' > > > > Now most of the spam messages are getting blocking, along with that many > > false positives too, sometimes it is tiresome. Is there any good > > suggestions please? > > > > -Nic > > What is your present configuration? Are you still running spamdyke? If > so, what's in your spamdyke.conf file? > > Have you implemented a whitelist with all of your vendors? > > What do you consider to be false positives? > > You might need to adjust the spamassassin thresholds to suite your > environment. Look at the scores of the false positives. If they're > slightly above the required_score in your local.cf file, you can adjust > that setting appropriately. > > Also, look to see which rules are contributing to your false positives. > Some rules may be inappropriate in your environment, causing some emails > to score too high. > > Adjusting a server to handle spam well is something that takes some > doing, but it isn't all that difficult. Once you have things set up for > your environment, things will run smoothly with most spam being caught, > and very few false positives. > > -- > -Eric 'shubes' > > > --------------------------------------------------------------------------------- > Qmailtoaster is sponsored by Vickers Consulting Group > (www.vickersconsulting.com) > Vickers Consulting Group offers Qmailtoaster support and installations. > If you need professional help with your setup, contact them today! > --------------------------------------------------------------------------------- > Please visit qmailtoaster.com for the latest news, updates, and packages. > > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > > New Windows 7: Find the right PC for you. Learn more. _________________________________________________________________ New Windows 7: Simplify what you do everyday. Find the right PC for you. http://windows.microsoft.com/shop
