[Solved]Spam is getting out of control

[grooveman]

Hi.

I run a sendmail server. I have been for years, and never had any problems. For about the last 16 months or so, however, spam started to seep in past my filters. I use spamassassin, I only allow ssl/tls traffic, I use three different SBLs (including spamhaus), I force authentication for all smtp, imap and pop traffic and I do not allow relay from any other servers. It has always been good enough. But not anymore. Messages squeak through with spamicity ratings of 2.0 and less. Baysean analysis is cranked as far is reason allows, and they still slip through, no matter how much the filter is trained. Spamassassin still bags about 75% of the total spam load coming in, but it still allows hundreds of spam emails through. My users are starting to miss legitimate email, and accidentally delete them because legit email is becoming the needle in the haystack.

I have googled on this for hours on end, and I cannot seem to find anything new on good practices for reducing spam. I did notice, however, that people are implementing things like SPF, DMARC and DKIM... I'm finding spotty information on how this applies to sendmail, and that few DNS providers actually support these records. Are these methods what people are using now days to stave-off spam? I don't have much time for this these days, and it looks like a LOT of work to set these things up...

Anyone out there managing an email server now and able to more or less thwart their spam?

Thanks.

G
_________________
To look without without looking within is like looking without without looking at all.

[eccerr0r]

I guess this is an advantage of google, hotmail, yahoo, etc. that collate a bunch of peoples' mail and thus can easily check mass produced mail from a particular server and cut them off...(which has the other side of the coin, google indeed is looking at your mails!).

I don't know if there really is a good solution. Best we had was learning like as you said, bayesian), but I ended up using a different approach: make sure I toss out spam ridden email addresses and make a new one... Any questionable email address gets its own disposable email address. Perhaps forward it to your 'main' address and remove the forwarding once spam through that avenue gets too high.

Yes, this is a pain to manage, but it's the best the small mail servers can do...
_________________
Intel Core i7 2700K/Radeon R7 250/24GB DDR3/256GB SSD
What am I supposed watching?

[UberLord]

[NeddySeagoon]

grooveman,

I use spamdyke in front of qmail.
I think the most effective filter is greylisting. Most spammers don't retry.
_________________
Regards,

NeddySeagoon

Computer users fall into two groups:-
those that do backups
those that have never had a hard drive fail.

[msst]

[grooveman]

Hmm... you guys have given me some things to think about here. I appreciate your input here (and welcome any more). I hope to have some time here soon to explore these options.

You guys are great.

Thanks.

G
_________________
To look without without looking within is like looking without without looking at all.

[grooveman]

I made a few tweaks and implemented dcc (as recommended by mas). Things still slipping through, though it seems like the filter got a little stronger (time will tell).

Here is an example of one of the nasty ones... actually scores a zero on Spamassassin, and gets past my SBLs.

[grooveman]

Ok... We are going on day 5 here, and I think I have this locked down. Adding DCC support gave it a little nudge, but was not enough. The silver bullet here was grey listing. I installed milter-greylist -- and what a difference! I had to disable the SPF exclusion, because all of these spams coming through had valid SPF records.

Implementing even a very lenient policy in grey-listing gives the SBLs out there enough time to catch these most nefarious spammers (who really seem to have done their homework on anti-spam measures).

I've always been leery of grey listing, and never used to need it, but when mails can get past SpamAssassin with scores of 2 and lower (even zero, as above) with the million tests it does AND have valid SPF records it became impossible to manage without. It really isn't that bad either, so far not causing any issues and it drove my spam bagging accuracy way above 99% now (in combination with SA).

Thank you mas-!

G
_________________
To look without without looking within is like looking without without looking at all.

[msst]

As an update, especially as you mentioned:

[grooveman]

Interesting.

I'm finding that greylisting seems to be enough. The biggest problem was the office 365 users. MS does some crazy round-robin and obfuscating tactics to ensure that you almost never get the same originating IP twice -- and to make matters worse, they seem to hold on to resend requests for several hours... sometimes nearly a day. That was angering some of my user base. Got around it though with wildcard usage in my greylist.conf.

I am curious though, you say you use adaptive greylisting. How is the "adaptive" portion accomplished? Through your own personal scripting, or does your greylist software accommodate this? I'm using sendmail with milter-greylist. What do you use?

Thanks

-G
_________________
To look without without looking within is like looking without without looking at all.

[msst]

[patrix_neo]

[gordonb3]

[msst]

[msst]

[gordonb3]

[msst]

[gordonb3]

Agreed on the part that this appears to be a real email server. I question your conclusion that the spammer(s) is the owner of that server though. Observe the envelope from address. It's completely bonkers and does not come anywhere close to the from address in the email. The prefix "BOUNCE_PREFIX-" appears to indicate here that the server actually contains a very ill-configured bouncing mechanism that silently forwarded this email to you because the original email to the (likely) non existent Vivienne Lorenz was marked as being sent by you.

[msst]