[spamdyke-users] Does one blacklisted address kill the delivery?

2010-08-21 Thread Angus McIntyre
Apologies if this question has been asked before, or the answer should be obvious. If Spamdyke detects a blacklisted address in the list of recipients, does it kill the entire connection (thus preventing the message being delivered to any recipient), or does it accept the message for the non-

Re: [spamdyke-users] using spamdyke with anti spam solution dspam vs mailscanner

2010-10-31 Thread Angus McIntyre
nightduke wrote: > I'm tired of spam, i want to use spamdyke with dspam or mailscanner. > I don't want to receive virus, i want to block spam with spamdyke but > also i want to have more features like dspam or mailscanner have, > after the mail server is a lotus domino server. > What's your opinion

Re: [spamdyke-users] Whitelists...

2011-06-13 Thread Angus McIntyre
ron wrote: > Whats the consensus, good or bad idea to whitelist all email addresses > within your company in spamdykes whitelist_recipients? Wouldn't that be rather counter-productive? If you whitelist all recipients at your company (and assuming that your mail server accepts mail only for people

Re: [spamdyke-users] Spamtrap-like setup

2011-06-22 Thread Angus McIntyre
Dossy Shiobara wrote: > Could use a .qmail file for each of those spamtrap addresses which > passes the message off to a script which plucks out the sender's IP > address (from the appropriate Received: header) and appends it to your > ip-blacklist-file. Because spammers may send mail from legitim

[spamdyke-users] ip-blacklist not matching

2012-01-12 Thread Angus McIntyre
Apologies in advance for what is undoubtedly going to turn out to be a "D'oh!" error on my part, but I'm running out of ideas here. I'm trying to block incoming mail from French snowshoe spammer "multi-fax.fr", who sends mail from a range of IP addresses and changes domain names every day to tr

Re: [spamdyke-users] ip-blacklist not matching

2012-01-12 Thread Angus McIntyre
Sebastian Grewe wrote: > Just a quick question: have you considered using RDNS blacklist instead? > Then you wouldn't need that many IPs for the same mail host. Thanks for the suggestion. But this particular spammer has a different invented domain name for each IP that they use (vedalcom.net, lirm

Re: [spamdyke-users] ip-blacklist not matching

2012-01-12 Thread Angus McIntyre
Sam Clippinger wrote: > Very strange. Is it possible you're using spamdyke on multiple ports > (e.g. 25 and 587) with different configuration files? I do use multiple ports, but qmail on 587 isn't invoking spamdyke at all (because users have to authenticate to connect to 587). The log messages I

Re: [spamdyke-users] ip-blacklist not matching

2012-01-12 Thread Angus McIntyre
David Mitchell wrote: > On 12/01/2012 11:41 PM, Angus McIntyre wrote: >> Apologies in advance for what is undoubtedly going to turn out to be a >> "D'oh!" error on my part, but I'm running out of ideas here. >> >> In my IP blacklist file at '/hom

[spamdyke-users] Recipient blacklist vs. RDNS checks

2012-02-14 Thread Angus McIntyre
Watching the logs on my new mail server, I'm having the pleasure of seeing spamdyke knocking lots of incoming spam on the head. In most cases, the incoming messages are getting taken out by RBL_MATCH, SENDER_NO_MX or RDNS_MISSING rules. A lot of the messages would eventually fail anyway because th

[spamdyke-users] Turning off 'denied other' for cannot sign errors

2012-02-15 Thread Angus McIntyre
I have Spamdyke running as part of a qmailtoaster install. One of the domains handled by the toaster accepts incoming mail, processes it using a Perl script based on Mail::Audit, and then resends the message to local or remote addresses. Most of the time, it works fine. However, for a small number

Re: [spamdyke-users] DDOS Help

2012-09-01 Thread Angus McIntyre
On Sep 1, 2012, at 11:17 AM, J.R. Lillard wrote: > I have a client that uses spamdyke but I am new to it. I've read through the > documentation so I am vaguely familiar with it now. They have been under a > DDOS attack for about a month now. It's not enough to bring their servers > down. B

Re: [spamdyke-users] Blocking mails with headers containing multiple addresses in From:

2012-12-08 Thread Angus McIntyre
Sam Clippinger wrote: > How interesting. I wonder why they're doing that -- do they think a mail > agent will check all of the addresses in the address book and refuse to > junk the message if one is found? "Never attribute to malice that which can be adequately explained by stupidity.

Re: [spamdyke-users] 0byte graylist entries

2013-11-23 Thread Angus McIntyre
BC wrote: > Yes. I realize that the impact of the delay is infrequent, but when it > happens, it's really annoying, and it impacts productivity. In my case, > it usually happens when an email confirmation or notification of some > sort is required to do something. This is the absolute worst time f

Re: [spamdyke-users] RBLs

2014-03-08 Thread Angus McIntyre
On Mar 8, 2014, at 6:52 AM, Gary Gendel wrote: > Almost all of my uncaught spam comes from two domains: > > colocrossing.com > hostnoc.net Color me unsurprised. I even think I know which spammer you're referring to. HostNoc/BurstNet has long had a reputation of being a spam-friendly hosting

Re: [spamdyke-users] RBLs

2014-03-08 Thread Angus McIntyre
BC wrote: > On 3/8/2014 7:03 AM, Angus McIntyre wrote: >> TL;DR: if you null-route every IP that HostNoc owns, it will make a >> dramatic difference to the amount of spam you see. > > To what does the "TL;DR" refer? "TL;DR" is Internet slang for 'To

Re: [spamdyke-users] Fwd: Search for High Speed Internet options near you

2014-06-03 Thread Angus McIntyre
On Jun 3, 2014, at 11:25 AM, David wrote: > How in the world do I stop these annoying emails. > according to the headers they change the > From: > Subject: > and the domains and ips change as well. It looks like an affiliate spammer. They typically rent a block of IP addresses from one or more

Re: [spamdyke-users] Uptick in spam

2014-06-11 Thread Angus McIntyre
On Jun 11, 2014, at 9:43 AM, Gary Gendel wrote: > In the last month, I've seen a large increase in spam that breezes through > spamdyke and spamassassin. These are html only emails mainly for jobs from > the big web companies (Google, Facebook, etc.). The html is biased with > bayes poisonin

[spamdyke-users] Wildcard blacklists for envelope sender

2014-07-24 Thread Angus McIntyre
One user on my server has attracted the attention of a spammer who seems to use a very particular pattern for their sporged 'From' addresses. The relevant lines in the log look like: spamdyke[14011]: ALLOWED from: spamtopic-user=mydomain@spamdomain.com to: u...@mydomain.com origin_ip ... 's

Re: [spamdyke-users] Help me to understand "503 MAIL first"

2015-06-22 Thread Angus McIntyre via spamdyke-users
On 2015-06-22 11:55, Alessio Cecchi via spamdyke-users wrote: one sender (and only this one) is unable to send email to my users, this is the error in spamdyke log: Jun 22 05:47:37 mx01 spamdyke[1066]: DENIED_OTHER from: i...@domain.net to: j...@domain.com origin_ip: 98.18.75.3 origin_rdns: stat

Re: [spamdyke-users] Fail2ban integration

2016-07-22 Thread Angus McIntyre via spamdyke-users
What log file are those messages from? Are they from '/var/log/maillog'? If so, you might look at /var/log/qmail/smtp/current to see if it offers anything you can use. On my system, spamdyke lines in that log include: origin_ip: 1.2.3.4 so if these attacks cause text to be written to that

Re: [spamdyke-users] Error unable to write to SSL/TLS stream

2021-03-03 Thread Angus McIntyre via spamdyke-users
I think spamdyke implements greylisting by sending a 421 Temporary Failure code on first connection. That might be what's happening here. Greylisting is off by default, but if you have it turned on you could set `graylist-level` to `none` to turn it off. If you want to keep it on but just fix it f