ISPConfig3 Spamfilter policy again..

Discussion in 'Installation/Configuration' started by oxygen, Feb 27, 2016.

  1. oxygen

    oxygen Member

    Hi guys.
    Here is my Spamfilter policy settings:

    SPAM tag level 3
    SPAM tag2 level 3.4
    SPAM kill level 5
    SPAM dsn cutoff level 0
    SPAM quarantine cutoff level 0
    SPAM modifies subject yes
    SPAM subject tag ***SPAM***
    SPAM subject tag2 ***SPAM***

    And anyway i'm receiving some spam sometimes marked with ***SPAM***, sometimes no.
    My blacklist: zen.spamhaus.org,bl.spamcop.net,psbl.surriel.com,combined.rbl.msrbl.net
    Mailserver is corporate, so without spam filtering there will be mass of spam. Maybe we should use more aggressive filtering?
    At Domain level spamfilter setting is Not Enabled. Modified Trigger happy settings are enabled for each mailbox.
    Thanks.
     
    Last edited: Feb 29, 2016
  2. oxygen

    oxygen Member

    Checked Spamfilter- User / Domain- each mailbox with Trigger Happy policy have priority "10".
     
  3. till

    till Super Moderator Staff Member ISPConfig Developer

    You can see in the mail header which rules got applied and which score the email has got. Then you can adjust the tag 2 level and kill level according to your needs.
     
  4. oxygen

    oxygen Member

    OK, i got another spam. Header:

    Return-Path: <[email protected]>
    X-Original-To: [email protected]
    Delivered-To: [email protected]
    Received: from localhost (localhost [127.0.0.1])
    by server.modilinos.com (Postfix) with ESMTP id 35B9C5025BA
    for <---@modilinos.com>; Tue, 1 Mar 2016 16:31:34 +0200 (EET)
    X-Virus-Scanned: Debian amavisd-new at server.modilinos.com
    Received: from server.modilinos.com ([127.0.0.1])
    by localhost (server.modilinos.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 9ie7wyCcv7RQ for <[email protected]>;
    Tue, 1 Mar 2016 16:31:26 +0200 (EET)
    Received: from web102.logicatorino.it (web102.logicatorino.it [178.255.72.190])
    by server.modilinos.com (Postfix) with ESMTPS id 2D23950212E
    for <[email protected]>; Tue, 1 Mar 2016 16:31:25 +0200 (EET)
    Received: from web3 by web102.logicatorino.it with local (Exim 4.80)
    (envelope-from <[email protected]>)
    id 1aal8s-00087e-RO
    for [email protected]; Tue, 01 Mar 2016 15:19:14 +0100
    To: [email protected]
    Subject: Why Not F5cking Me?
    X-PHP-Originating-Script: 1004:utf.php(1974) : eval()'d code
    Date: Tue, 1 Mar 2016 15:19:14 +0100
    From: Cindy Haynes <[email protected]>
    Message-ID: <[email protected]>
    X-Priority: 3
    X-Mailer: PHPMailer 5.2.9 (https://github.com/PHPMailer/PHPMailer/)
    MIME-Version: 1.0
    Content-Type: multipart/alternative;
    boundary="b1_3ecf6df4568a1519196b600653c78f88"
    Content-Transfer-Encoding: 8bit
     
    Last edited: Mar 1, 2016
  5. oxygen

    oxygen Member

    my settings:
    [​IMG]
    [​IMG]
     
  6. oxygen

    oxygen Member

    Now received spam with marked subject:

    Return-Path: <[email protected]>
    X-Original-To: [email protected]
    Delivered-To: [email protected]
    Received: from localhost (localhost [127.0.0.1])
    by server.modilinos.com (Postfix) with ESMTP id 3C338502A74
    for <[email protected]>; Tue, 1 Mar 2016 20:18:50 +0200 (EET)
    X-Virus-Scanned: Debian amavisd-new at server.modilinos.com
    X-Spam-Flag: NO
    X-Spam-Score: 3.303
    X-Spam-Level: ***
    X-Spam-Status: No, score=3.303 tagged_above=3 required=3.4
    tests=[BAYES_50=0.8, DIET_1=0.001, HTML_FONT_LOW_CONTRAST=0.001,
    HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H2=-0.001, RDNS_NONE=0.793,
    SPF_HELO_PASS=-0.001, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01,
    URIBL_BLACK=1.7] autolearn=no autolearn_force=no
    Received: from server.modilinos.com ([127.0.0.1])
    by localhost (server.modilinos.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id 5f66u-RW8zot for <[email protected]>;
    Tue, 1 Mar 2016 20:18:42 +0200 (EET)
    Received: from denmatop.xyz (unknown [185.132.126.114])
    by server.modilinos.com (Postfix) with ESMTP id C9A58502A73
    for <[email protected]>; Tue, 1 Mar 2016 20:18:40 +0200 (EET)
    From: "Oz-Online" <[email protected]>
    Date: Tue, 01 Mar 2016 13:00:04 -0500
    MIME-Version: 1.0
    Subject: ***SPAM***Dr_Oz reveals obesity reversal method
    To: <[email protected]>
    Message-ID: <S3cStXRq64QH5gdmNLPw9bkcjRuzbP-96xO9lFltfjA.MIyfXlzx9XOIcTTbaEauq[email protected]>
    Content-Type: multipart/alternative;
    boundary="------------87736373769188743763762"
     
    Last edited: Mar 1, 2016
  7. till

    till Super Moderator Staff Member ISPConfig Developer

    Please do not post spam emails incl. real email addresses here. This will just get you more spam as spam bots grab email addresses from forums.

    Did you select the spamfilter policy for the whole domain (in the email domain settings) or did you set it just for the agency@ mailbox?
     
  8. oxygen

    oxygen Member

    Thanks Till for your answers.
    At Domain level spamfilter setting is Not Enabled. Modified (3-3.4-5) Trigger happy settings are enabled for each mailbox.
     
  9. oxygen

    oxygen Member

    ok, next not marked spam :)

    Return-Path: <[email protected]>
    X-Original-To: [email protected]
    Delivered-To: [email protected]
    Received: from localhost (localhost [127.0.0.1])
    by server.modilinos.com (Postfix) with ESMTP id 19E9B502AD1
    for <[email protected]>; Tue, 1 Mar 2016 20:45:03 +0200 (EET)
    X-Virus-Scanned: Debian amavisd-new at server.modilinos.com
    Received: from server.modilinos.com ([127.0.0.1])
    by localhost (server.modilinos.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id Rjj4S22FTQGd for <[email protected]>;
    Tue, 1 Mar 2016 20:44:58 +0200 (EET)
    Received: from danielghoffman.info (unknown [185.132.126.106])
    by server.modilinos.com (Postfix) with ESMTP id 19D51502AD0
    for <[email protected]>; Tue, 1 Mar 2016 20:44:57 +0200 (EET)
    From: "CNN-Breaking" <[email protected]>
    Date: Tue, 01 Mar 2016 13:20:18 -0500
    MIME-Version: 1.0
    Subject: My hips shrank from 51 to 34 inches in 7 days
    To: <[email protected]>
    Message-ID: <IvDXjli006x6mDgj_fojrwe2hErda5Q-PR34ICA1zd0.U_vBgE220LCQZcJIcneh1[email protected]>
    Content-Type: multipart/alternative;
    boundary="------------35820088190528313835174"
     
    Last edited: Mar 1, 2016
  10. oxygen

    oxygen Member

    OK, later i will edit my messages and delete addresses.
     
  11. till

    till Super Moderator Staff Member ISPConfig Developer

    Enable it on domain level. and set spam tag level to -100 (the first level, not tag 2!!)
     
  12. oxygen

    oxygen Member

    Should i leave spam filter for each mailbox as is?
    just add domain level filters with -100,3.4,5 ?
     
  13. till

    till Super Moderator Staff Member ISPConfig Developer

    Thats only nescessary if one mailbox shall have a different level compared to the one set for the domain.

    That's ok.
     
  14. oxygen

    oxygen Member

    OK, i did that. Now i have -100,3.4,5 policy at domain level only.
    Let's test it, thanks Till one more time.
     
  15. oxygen

    oxygen Member

    Last news: inside users messages was markes as spam. Here is header:


    Return-Path: <user1@modilinos.com>
    X-Original-To: [email protected]
    Delivered-To: [email protected]
    Received: from localhost (localhost [127.0.0.1])
    by server.modilinos.com (Postfix) with ESMTP id 228A3502E0A
    for <[email protected]>; Tue, 1 Mar 2016 22:52:36 +0200 (EET)
    X-Virus-Scanned: Debian amavisd-new at server.modilinos.com
    X-Spam-Flag: NO
    X-Spam-Score: -2.898
    X-Spam-Level:
    X-Spam-Status: No, score=-2.898 tagged_above=-100 required=3.4
    tests=[AC_DIV_BONANZA=0.001, ALL_TRUSTED=-1, BAYES_00=-1.9,
    HTML_MESSAGE=0.001] autolearn=ham autolearn_force=no
    Received: from server.modilinos.com ([127.0.0.1])
    by localhost (server.modilinos.com [127.0.0.1]) (amavisd-new, port 10024)
    with ESMTP id joLevSkM0gPq for <[email protected]>;
    Tue, 1 Mar 2016 22:52:29 +0200 (EET)
    Received: from jolantathink (78-56-111-190.static.zebra.lt [78.56.111.190])
    (Authenticated sender: [email protected])
    by server.modilinos.com (Postfix) with ESMTPSA id C4A7B502E09
    for <[email protected]>; Tue, 1 Mar 2016 22:52:29 +0200 (EET)
    From: "Jolanta MODILINOS" <[email protected]>
    To: =?UTF-8?Q?'Modilinos_modeli=C5=B3_agent=C5=ABra'?= <[email protected]>
    Subject: ***SPAM***FW: JUSTE option in May!
    Date: Tue, 1 Mar 2016 22:52:30 +0200
    Message-ID: <[email protected]>
    MIME-Version: 1.0
    Content-Type: multipart/related;
    boundary="----=_NextPart_000_03B0_01D1740D.095F1C40"
    X-Mailer: Microsoft Office Outlook 12.0
    Thread-Index: AdFzqacQgrJTUdOkRqqdJ35BLskeagAUpjxw
    Content-Language: lt



    Now i set Tag lever to 1, it's ok?
    Now policy is 1,3.4,5
     
  16. Jesse Norell

    Jesse Norell Active Member

    That's not determined to be spam, it's only tagged as such because of:

    Code:
    SPAM subject tag ***SPAM***
    Leave "SPAM subject tag" empty (the default) and it should fix that.

    On the subject of spamassassin performance in general, it's not usually the best idea to just start dropping score threshholds to catch more spam. Yes, you will catch more, but you'll also have a lot more false positives; if you run a small server with limited users where you can keep an eye on things you might get away with it more, especially if you use bayes is trained well. But instead of dropping score threshholds too far, consider adding more tests to bump the score up, ie. make spamassassin actually do a better job. Train bayes, update to current spamassassin version, look at optional tests that aren't enabled by default, add some 3rd party rules, etc.
     
  17. oxygen

    oxygen Member

    Ah yes, i deleted string SPAM subject tag and make -100,3.4,5 again.
    But mass of marked spam this morning (yesterday i did 1,3.4,5) with scores 1.8-4.8.
    can i try -100, 2, 3 configuration?
     
  18. till

    till Super Moderator Staff Member ISPConfig Developer

    Yes, you can use any level that matches your needs to filter out messages. The first level (-100) just means when amavis shall start to write scores into the header, so that can be that low if you want to know what the system is doing as it has no influence on spam scoring. The other two level are for marking spam in the title and header and the third level is when spam gets deleted.
     
    oxygen likes this.

Share This Page