Topic: lots of spam
==== Required information ====
- iRedMail version (check /etc/iredmail-release): 0.9.5-1
- Linux/BSD distribution name and version: ubuntu 16
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): mysql
- Web server (Apache or Nginx):apache
- Manage mail accounts with iRedAdmin-Pro? yes
- [IMPORTANT] Related original log or error message is required if you're experiencing an issue.
====
Hey everybody,
seems like my iredmail server getting tons of spam and giving everything really low score.
for example:
May 16 23:02:08 i2 amavis[17180]: (17180-12) Passed SPAM {RelayedInbound}, [192.99.125.118]:51069 [192.99.125.118] <survivalist.community@hipies.net> -> <my@mail.com>, Queue-ID: 16F075FEEF, Message-ID: <Z6.Wey08lg.8Z8mQaRVNL7zw0pY@peace.hipies.net>, mail_id: uESt3wNX4hvb, Hits: 0.01, size: 39299, queued_as: C91AB65E4A, 1062 ms, Tests: [HTML_MESSAGE=0.001,SPF_HELO_PASS=-0.001,SPF_PASS=-0.001,T_KAM_HTML_FONT_INVALID=0.01,URIBL_BLOCKED=0.001]
May 16 23:02:08 i2 postfix/smtp[18450]: 16F075FEEF: to=<my@mail.com>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.9, delays=0.81/0/0/1.1, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as C91AB65E4A)
i dont understang why "URIBL_BLOCKED" gets so slow score if this domain listed in uribl?
im also using policy from amavis database:
id 2
policy_name Antispam Policy
virus_lover N
spam_lover Y
unchecked_lover Y
banned_files_lover N
bad_header_lover Y
bypass_virus_checks N
bypass_spam_checks N
bypass_banned_checks N
bypass_header_checks N
virus_quarantine_to NULL
spam_quarantine_to NULL
banned_quarantine_to NULL
unchecked_quarantine_to NULL
bad_header_quarantine_to NULL
clean_quarantine_to NULL
archive_quarantine_to NULL
spam_tag_level 3
spam_tag2_level 3
spam_tag3_level 3
spam_kill_level 0
spam_dsn_cutoff_level 0
spam_quarantine_cutoff_level 0
addr_extension_virus NULL
addr_extension_spam NULL
addr_extension_banned NULL
addr_extension_bad_header NULL
warnvirusrecip NULL
warnbannedrecip NULL
warnbadhrecip NULL
newvirus_admin NULL
virus_admin NULL
banned_admin NULL
bad_header_admin NULL
spam_admin NULL
spam_subject_tag NULL
spam_subject_tag2 NULL
spam_subject_tag3 NULL
message_size_limit NULL
banned_rulenames NULL
disclaimer_options NULL
forward_method NULL
sa_userconf NULL
sa_username NULL
my spamassassin local.cf file:
required_score 5.0
rewrite_header subject [ SPAM ]
report_safe 0
lock_method flock
#
# Bayesian support
#
# References:
# - http://wiki.apache.org/spamassassin/BayesInSpamAssassin
# - http://svn.apache.org/repos/asf/spamass … ADME.bayes
# Addition plugin for Roundcube webmail to call sa-learn
# - http://www.tehinterweb.co.uk/roundcube/#pimarkasjunk2
#
use_bayes 1
bayes_auto_learn 1
bayes_auto_expire 1
# Store bayesian data in MySQL.
# Please make sure you have correct server address, port and database name.
#bayes_store_module Mail::SpamAssassin::BayesStore::MySQL
#bayes_sql_dsn DBI:mysql:sa_bayes:127.0.0.1:3306
# Store bayesian data in PostgreSQL.
# Please make sure you have correct server address, port and database name.
#bayes_store_module Mail::SpamAssassin::BayesStore::PgSQL
#bayes_sql_dsn DBI:Pg:sa_bayes:127.0.0.1:5432
# SQL username and password.
#bayes_sql_username db_username
#bayes_sql_password db_password
# Override the username used for storing data in the database.
# This could be used to group users together to share bayesian filter data.
# You can also use this config option to trick sa-learn to learn data as a specific user.
#bayes_sql_override_username vmail
# Turn off ALL DNSBL (DNS Blocklists)
#skip_rbl_checks 1
# Turn off DNSBL: rhsbl.ahbl.org.
# Check /usr/share/spamassassin/20_dnsbl_teest.cf to see the rule name.
score DNS_FROM_AHBL_RHSBL 0
score URIBL_AB_SURBL 0 0.3306 0 0.3812
score URIBL_JP_SURBL 0 0.3360 0 0.4087
score URIBL_OB_SURBL 0 0.2617 0 0.3008
score URIBL_PH_SURBL 0 0.2240 0 0.2800
score URIBL_SBL 0 0.1094 0 0.1639
score URIBL_SC_SURBL 0 0.3600 0 0.4498
score URIBL_WS_SURBL 0 0.1533 0 0.2140
score URIBL_ABUSE_SURBL 2.7
# Whitelist from SPF.
#whitelist_from_spf joe@example.com fred@example.com
#whitelist_from_spf *@example.com
# Whitelist from DKIM.
loadplugin Mail::SpamAssassin::Plugin::DKIM
whitelist_from_dkim *@paypal.com
whitelist_from_dkim *@linkedin.com
whitelist_from_dkim *@twitter.com
whitelist_from_dkim *@bounce.twitter.com
# Whitelist domains.
# Reference: http://wiki.apache.org/spamassassin/ManualWhitelist
#whitelist_from *@gmail.com
# Locales.
ok_locales all
what can i do to improve the spam detecting?
Thank you
raz
----
Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.