Input Warden Antispam & Virus Protection Extension for Plesk

[danami]

Very impressed with the product so far. Wondering if there is any sort of report that provides in-sight to the effectiveness of DNSBL sites?

Thanks for the positive feedback. As to the DNSBL effectiveness there are some online resources that will show you the effectiveness of some of the more popular DNSBLs:

Blacklist Monitor » Statistics of accuracy and failure rates

ORF Fusion. Simply different.

Award winning e-mail security and monitoring software for Microsoft Exchange and IIS. Fully scalable from SMB to enterprise with a budget-friendly price.

vamsoft.com

Also we have a list that we recommend in our documentation:

Getting Started | Warden Anti-spam and Virus Protection Documentation

Warden Anti-spam and Virus Protection

docs.danami.com

 

[danami]

Warden Anti-spam and Virus Protection 2.08 has been released. AlmaLinux support, third party rules, and more! Announcement: Announcements - Danami

 

[danami]

Warden Anti-spam and Virus Protection 2.10 for has been released. IMAP/POP3 Tracking, Bug Fixes, and More! Announcement: Announcements - Danami

 

[bkkcanuck]

I have a question, I have installed the trial of your product and so far like very much what I see.

One particular problem I have been having with a client site is a spoofed "reply to" input. Actually let me show you an example.

From: rh60 <[email protected]>
Date: June 30, 2021 at 3:56:29 AM EDT
To: [email protected]
Subject: New Message From Sente Building Group
Reply-To: "\"rh60\"" <[email protected]99.mokomichi.xyz>, rh60 <[email protected]>

If you look above you will see I have changed the client's actual domain to "realdomain.com" for this email. But in the "FROM" field it is showing a legit email address from within their domain. The "TO" field is also legit.

The only thing that is clearly wrong is the first entry in the "REPLY TO" line you can see the spammers actual email or a placeholder.

My question is can I set up a rule that would filter a message like this as SPAM and have it not go to the client? For this ONE particular client as they would NEVER send an email with TWO reply-to addresses in one email.

Thoughts?

 

[danami]

I have a question, I have installed the trial of your product and so far like very much what I see.

One particular problem I have been having with a client site is a spoofed "reply to" input. Actually let me show you an example.

From: rh60 <[email protected]>
Date: June 30, 2021 at 3:56:29 AM EDT
To: [email protected]
Subject: New Message From Sente Building Group
Reply-To: "\"rh60\"" <[email protected]99.mokomichi.xyz>, rh60 <[email protected]>

If you look above you will see I have changed the client's actual domain to "realdomain.com" for this email. But in the "FROM" field it is showing a legit email address from within their domain. The "TO" field is also legit.

The only thing that is clearly wrong is the first entry in the "REPLY TO" line you can see the spammers actual email or a placeholder.

My question is can I set up a rule that would filter a message like this as SPAM and have it not go to the client? For this ONE particular client as they would NEVER send an email with TWO reply-to addresses in one email.

Thoughts?

Warden allows you to add any type of custom spamassassin rule. You could easily add a rule for this under the Warden rules tab. A similar example:

SpamAssassin, Postfix, and Multiple Addresses in From Header

I'm working on a problem that I'm seeing with an email scanning server (MailScanner, Spamassassin, Postfix, etc.), and From header spoofing. Unfortunately, some of the versions of these components...

serverfault.com

You would juse use the reply-to: field instead of the from: in the example

 

[Pagemakers]

1. Does this extension require extensive technical knowledge to use?
2. Are spam messages auto-deleted after x days?

 

[danami]

1. Does this extension require extensive technical knowledge to use?
2. Are spam messages auto-deleted after x days?

1. No not really.
2. Yes. The admin can even configure how many days they want to keep spam in the users spam folders.

 

[Pagemakers]

Thank you. I’ll uninstall Plesk Email Security and install Warden over the weekend.

We’ve changed our server and the old one has MagicSpam free. The new server has Plesk Email Security and it lets through much more spam and doesn’t auto-delete email so I’m looking to change.

If I wanted can Warden only install anti-spam or must all the modules be installed?

 

[danami]

If I wanted can Warden only install anti-spam or must all the modules be installed?

You only need Warden installed.

 

[Pagemakers]

Thank you. So to confirm I could just install anti-spam without anti-virus etc?

 

[danami]

Thank you. So to confirm I could just install anti-spam without anti-virus etc?

You could but it's not recommended. I would never run a mail server without anti-virus on it.

 

[Pagemakers]

Thanks. I’ll install the whole package via Plesk extension.

 

[Pagemakers]

How long does the installer take? It’s been 15 minutes so far

 

[danami]

How long does the installer take? It’s been 15 minutes so far

Open a support ticket if you have trouble.

 

[Pagemakers]

Worked the 2nd time. Thank you.

 

[Pagemakers]

Is it possible to rename the Warden Antispam and Virus Protection link in the Plesk left panel. It’s a bit long and wraps over 2 lines. I’d just like to call it Warden

 

[Pagemakers]

Is there any simple way to learn from messages in the main logs page.

EG: Warden identifies an email as SPAM - is there any easy way to say it’s not spam or vice-versa?

 

[danami]

EG: Warden identifies an email as SPAM - is there any easy way to say it’s not spam or vice-versa?

Yes the user can just mark the message as HAM in their desktop email client or though their webmail. Warden has real-time learning. It uses the dovecot service to train the Anti-spam system any time a user moves a message to or from their spam folder.

You can read more about it here:

How does the real-time spam training in Warden Anti-spam and Virus Protection work? - Knowledgebase - Danami

 

[Pagemakers]

This replies on the user doing the right thing and not simply deleting the email.

I wish the admin could simply mark spam and ham emails via the logs page. I guess it’s not possible. I used to do this with MagicSpam.

 

[danami]

I wish the admin could simply mark spam and ham emails via the logs page. I guess it’s not possible. I used to do this with MagicSpam.

You can whitelist an email from the log by clicking on the recipient address then bringing up their mailbox policy but it's better for bayes real training to be done at the user level (or within Warden in the quarantine area) because then you are learning from the actual content of the message and not just the from: address which can be easily forged.