spam

[brynk]

I'm using spam assassin, SPF spam protection and DNS blackhole lists to keep mailboxes from being bombarded with spam.
Using Plesk 8.3 it went pretty well, but lately more and more spam was trickling through the filters (not a lot, but is was getting annoying). I was hoping the update to 8.4 would help blocking the new spam, but instead it seems to have gotten worse.
Since I installed the 8.4 update I've gotten more spam than I have in quite a while. Does anyone else have this problem or do you have any tips for me?

 

[faris]

Consider installing spamdyke.

www.spamdyke.org

Faris.

 

[wsani]

Or you can purchase 4PSA spamguardian, it works really well!

 

[brynk]

I'm sure these options both work fine, but my point is that spamassassin did to. I should be able to get things working good again using the software I've already got installed.

 

[atomicturtle]

Spam is an arms race, there is no silver bullet here I'm afraid. I can make a few other recommendations here, if you can use RBL's, try zen.spamhaus.org. Its the best RBL out there, just keep in mind that you could block users coming from open proxies and known spam sources. I just tell those folks to use the submission port to send on my servers.

Next, install razor, dcc, and pyzor. I have rpms available in my archive.

Lastly, greylisting, this is what spamdyke does. Its marginally effective, but nothing super special. Ive got rpms for that too (qgreylist).

Update your SA rules, spamassassin has an internal utility to do this called sa-update. Its not enabled by default in any kind of cron job. You'll have to run it manually.

 

[brynk]

Thanks for the tips.
I am already using zen.spamhaus.org and I make sure the spamassassin rules are up to date.
As I said, using these methods all went pretty well, especially considering the amount of spam being sent these days. It's just that it got worse after the last Plesk update, so I figured something had changed and maybe I could change it back.
I'll look into the things you mentioned and see if that'll get things back to normal.

 

[Kostya]

I have had the same problem after update to 8.4.0. To resolve this disable DNSBL and save settings. Then enable DNSBL whith your prefered settings again. My problem was solved on this way.

 

[brynk]

Thanks, I just did as you said. Now I'll just wait and see...

 

[brynk]

Still no good. I was thinking that probably all the options in the mail server section don't work. In my case that's at least true for the relaying options, the DNSBL service and the use of short account names. I'll look into the other options later today.
Since this is a pretty major bug and it's been a while since the update was released I think it's pretty bad I haven't heard anything about it from Parallels...

 

[brynk]

I'm still having problems. I guess there's probably something wrong with the server_args in the smtp_psa. My line is like this:

server_args = -Rt0 /usr/sbin/rblsmtpd -r zen.spamhaus.org /var/qmail/bin/relaylock /var/qmail/bin/qmail-smtpd /var/qmail/bin/smtp_auth /var/qmail/bin/true /var/qmail/bin/cmd5checkpw /var/qmail/bin/true

It used to work fine like this, but after the update I had to ad
env = SMTPAUTH=1 SHORTNAMES=1

to get SMTP authentication working again.

Any help would be appreciated.

 

[kuhle]

zen.spamhaus.org

A number of you have mentioned using zen.spamhaus.org in the RBL

I used to use this, but it seems to be messing up the server at the moment. When people send emails, it takes about 30 secs for the message to leave the Outbox. When I disable RBL, the emails are sent straight away.

I raised this with SW Soft, and they said:

the problem is that 'sbl.spamhaus.org' DNS zone (or any of DNS servers hosting this zone) is not accessible from your server:

-bash-2.05b# host 2.0.0.127.sbl.spamhaus.org
;; connection timed out; no servers could be reached

while it is from other locations, e.g. my workstation:

cat:~$ host 2.0.0.127.sbl.spamhaus.org
2.0.0.127.sbl.spamhaus.org has address 127.0.0.2

This might be the result of traffic blocking on ISP level as said here: http://www.spamhaus.org/faq/answers.lasso?section=DNSBL Usage#83

Please, check with your provider if they allow traffic to DNSBL servers.

I wonder whether I have reached a limit that exceeds the free use? http://www.spamhaus.org/organization/dnsblusage.html. I tried to sign up to the free trial, thinking that I could then simply put their link on my RBL page, but their instructions were very long-winded and went slightly over my head.

Can anyone shed any light on this or offer any advice?