Re: Filtering at border routers: Is it possible?

2019-03-22 Thread John Hardin
On Fri, 22 Mar 2019, Anthony Hoppe wrote: Not knowing the details of your environment... Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Benny Pedersen
bruno.carva...@xervers.pt skrev den 2019-03-22 21:31: Thank you all for your suggestions. I will follow the path of using a whitelist and block everyone. I can track the IPs, but i taught i could put in place something (like OVH by example) do (If their system detects spam being sent, the port

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Benny Pedersen
John Hardin skrev den 2019-03-22 22:23: Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for it to be unblocked? +1 custommers wish for

Re: DKIMWL's dubious methodology.

2019-03-22 Thread RW
On Fri, 22 Mar 2019 19:45:38 + Paul Stead wrote: > Hi > > bestchoicebrand.net is not and has not been listed on DKIMwl > > Can you clarify who DKIM signed the email? Very likely to be > amazonses.com or Google Apps SMTP? Yes, I misread it, it has DKIM-Signature:

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Benny Pedersen
Anthony Hoppe skrev den 2019-03-22 18:23: Not knowing the details of your environment... Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for it

Re: DKIMWL's dubious methodology.

2019-03-22 Thread Paul Stead
Hi bestchoicebrand.net is not and has not been listed on DKIMwl Can you clarify who DKIM signed the email? Very likely to be amazonses.com or Google Apps SMTP? Paul On 22/03/2019, 19:23, "RW" wrote: I got a spam yesterday that hit DKIMWL_WL_MED on the domain bestchoicebrand.net.

RE: Filtering at border routers: Is it possible?

2019-03-22 Thread bruno.carvalho
Thank you all for your suggestions. I will follow the path of using a whitelist and block everyone. I can track the IPs, but i taught i could put in place something (like OVH by example) do (If their system detects spam being sent, the port on that ip is automatically blocked and the client

Re: RE: Filtering at border routers: Is it possible?

2019-03-22 Thread Rupert Gallagher
I think you are in for a lot of pain. This is the view from my seat. If my company has a client that sends spam using my IP, then my IP earns a bad reputation and is blacklisted. Therefore, my other clients are blacklisted too, even if they do not send spam. If I do not solve the problem, then

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 3:23 PM, Benny Pedersen wrote: you only need sasl auth You should do the SMTP Authentication across STARTTLS to protect credentials. do not enable sasl auth on port 25, if it lists AUTH on port 25 ehlo, you will need to remove  it in postfix main.cf enable sasl auth only on

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Dave Warren
On 2019-03-22 18:39, Grant Taylor wrote: On 3/22/19 3:29 PM, Benny Pedersen wrote: custommers wish for port 25 open relay ? Having unfettered access to send traffic to TCP port 25 is /not/ the same thing as an open relay. Especially if you are a host with your clients running self-managed

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 1:54 PM, Benny Pedersen wrote: dont relay mail from port 25, What do you mean by that? Are you talking about the TCP connection originating from port 25? Or something else? Also, why not? mails there is final recipient only, not forwared I disagree. I see people forward

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Noel Butler
On 23/03/2019 05:54, Benny Pedersen wrote: > dont relay mail from port 25, mails there is final recipient only, not > forwared you ave not been taking your medication again Benny -- Kind Regards, Noel Butler This Email, including any attachments, may contain legally

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 8:01 PM, Kevin A. McGrail wrote: Noel, please.  The personal attacks aren't in keeping with our code of conduct.  Please don't email them to the list. +1 Let's keep things professional. IMO and I believe the RFCs back me up, Port 25 should only be used for local recipients.  Port

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Benny Pedersen
Noel Butler skrev den 2019-03-23 02:44: you ave not been taking your medication again Benny it keeps me awake atleast :) its weekend and i was borring creating gentoo ebuild for pymilter 1.0.2, repoman -d full is happy, so i am aswell

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 3:29 PM, Benny Pedersen wrote: custommers wish for port 25 open relay ? Having unfettered access to send traffic to TCP port 25 is /not/ the same thing as an open relay. -- Grant. . . . unix || die smime.p7s Description: S/MIME Cryptographic Signature

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread John Hardin
On Fri, 22 Mar 2019, Benny Pedersen wrote: John Hardin skrev den 2019-03-22 22:23: Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for it to

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Dave Warren
On 2019-03-22 18:37, Grant Taylor wrote: On 3/22/19 3:23 PM, Benny Pedersen wrote: you only need sasl auth You should do the SMTP Authentication across STARTTLS to protect credentials. do not enable sasl auth on port 25, if it lists AUTH on port 25 ehlo, you will need to remove  it in

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Kevin A. McGrail
On 3/22/2019 9:44 PM, Noel Butler wrote: > > On 23/03/2019 05:54, Benny Pedersen wrote: > >> >> dont relay mail from port 25, mails there is final recipient only, >> not forwared >>   >   > > you ave not been taking your medication again Benny > Noel, please.  The personal attacks aren't in

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 7:01 PM, Dave Warren wrote: To me, the big one is this: It sets your users up for failure. If a user configures their client on a network that allows unrestricted port 25 access and later moves (temporarily or permanently) to a network that does restrict port 25, they'll get an

Filtering at border routers: Is it possible?

2019-03-22 Thread Bruno Carvalho
Hello Folks. I've just joined this list, i didn't read all rules yet (just some), so bare with me if my question is misplaced. I own a small datacenter with 4 uplinks. And i received complains that some of my clients are using my services for sending spam. I wanted to know if it is possible to

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Anthony Hoppe
Not knowing the details of your environment... Instead of taking on the job of filtering email for all of your clients (this, to me, will open up a can of worms), why not set a policy that port 25 is blocked by default and customers must request for it to be unblocked? You can then build a

fn spamhaus spamming ips

2019-03-22 Thread Benny Pedersen
# X-Spam-ASN: AS202933 212.22.77.0/24 # X-Spam-ASN: AS9123 213.226.124.0/24 # X-Spam-ASN: AS45027 185.128.213.0/24 # X-Spam-ASN: AS206440 109.248.10.0/23 # X-Spam-ASN: AS8732 213.79.64.0/18 seen as free riders in spamhaus :( spam is sent to role account and utf8 only body seen its a maillist

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread @lbutlr
On 22 Mar 2019, at 10:59, Bruno Carvalho wrote: > So, if someone knows a way to filter the mail traffic and block outbound > spam, i will be thankfull. tl;dr this is not a problem for SpamAssassin to fix. All outbound mail from anyone in your datacenter running a mail server will have to go

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Matt V
M3AAWG has a BCP for hosting providers, you might find some valuable ideas within it on how to address your issues: https://www.m3aawg.org/sites/default/files/document/M3AAWG_Hosting_Abuse_BCPs-2015-03.pdf Cheers, Matt On 2019-03-22 12:59 p.m., Bruno Carvalho wrote: Hello Folks. I've

Re: Filtering at border routers: Is it possible?

2019-03-22 Thread Grant Taylor
On 3/22/19 10:59 AM, Bruno Carvalho wrote: Hello Folks. Hi, I've just joined this list, i didn't read all rules yet (just some), so bare with me if my question is misplaced. Welcome. I own a small datacenter with 4 uplinks. And i received complains that some of my clients are using my

DKIMWL's dubious methodology.

2019-03-22 Thread RW
I got a spam yesterday that hit DKIMWL_WL_MED on the domain bestchoicebrand.net. This domain was less that 24 hours old at the time of scanning and has no A record or SPF TXT record. I don't think a domain can have any meaningful good reputation in such a short period of time, and IMO a valid SPF

Re: DKIMWL's dubious methodology.

2019-03-22 Thread Benny Pedersen
RW skrev den 2019-03-22 20:16: I got a spam yesterday that hit DKIMWL_WL_MED on the domain bestchoicebrand.net. This domain was less that 24 hours old at the time of scanning and has no A record or SPF TXT record. hopefully listnings owners check now, could be listed wl_none ? I don't think a

Re: No longer just embedded =9D characters in blackmail emails.

2019-03-22 Thread Savvas Karagiannidis
On 21/3/2019 18:23, John Hardin wrote: On Thu, 21 Mar 2019, Savvas Karagiannidis wrote: What should be considered is the message's language. All messages that were false positives had the following mime encoding (messages were actually in greek): Content-Type: text/[plain|html];