1 Topic by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Topic: Amavis+Spamassassin+reject_rbl_client = SPAM

==== Required information ====
- iRedMail version: 0.9.2
- Store mail accounts in which backend (LDAP/MySQL/PGSQL): MySQL
- Web server (Apache or Nginx): Apache
- Linux/BSD distribution name and version: Debian 8.1
- Related log if you're reporting an issue:
====

I'm trying to figure out why, with all of the stuff that I've got configured, I'm still getting a large amount of spam. Amavis + Spamassassin don't seem to be correctly scoring spammy emails, and I've got multiple blacklists configured in /etc/postfix/main.cf:

Here are my smtpd_recipient_restrictions:

smtpd_recipient_restrictions = reject_unknown_recipient_domain, reject_non_fqdn_recipient, reject_unlisted_recipient, check_policy_service inet:127.0.0.1:7777, permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_rbl_client zen.spamhaus.org, reject_rbl_client bl.spamcop.net, reject_rbl_client cbl.abuseat.org, reject_rbl_client psbl.surriel.com, reject_rbl_client dnsbl.sorbs.net, reject_rbl_client bl.spamcannibal.org, reject_rbl_client ubl.unsubscore.com, reject_rbl_client all.spamrats.com

With all of that configured, I'm still getting hit with a ton of spam that isn't getting marked / scored correctly, and is getting passed directly to users' inboxes. I'm trying to deal with them as they come along, via firewalling off IP addresses, and all, but I just can't seem to keep up, and it's exhausting. What am I missing, here?

Thanks all!

----

Spider Email Archiver: On-Premises, lightweight email archiving software developed by iRedMail team. Supports Amazon S3 compatible storage and custom branding.

2 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

Maybe you should slightly decrease spam score set in Amavisd to catch more spams.

With iRedAdmin-Pro, you can set spam score in System -> Anti spam -> Global Spam Policy.

3 Reply by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

Thanks Zhang, I'll give that a shot...

4 Reply by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

I took my spam scoring down a bit, and modified some things in my smtpd_recipient_restrictions... Hopefully I can get a handle on all of the spam that's getting thrown at one of my users... He's been getting absolutely crushed. He's obviously had his email address harvested by every spam bot on the internet, and I've been trying to stop it before it gets queued.

5 Reply by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

I still seem to have an unusually high amount of spam messages coming in and getting queued instead of being rejected before getting queued. The reject_rbl_client option in postfix's smtpd_recipient_restrictions doesn't seem to be hitting the blacklists every time. I'm not sure what's going on. How can I debug this?

6 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

Check iRedAPD log file, did iRedAPD incorrectly whitelist some spams?

7 Reply by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

Sorry, Zhang. I wasn't specific about the blacklists to which I was referring. I was referring to the reject_rbl_client(s) that I have configured in my postfix/main.cf

8 Reply by SteveLuxe

  • SteveLuxe
  • Member
  • Offline
  • Registered: 2015-06-02
  • Posts: 115

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

So evidently, the solution to the problem was installing Bind9, and running my own local caching DNS server. Spamhaus wasn't allowing me to do queries using high-traffic public DNS servers. I had to set up my own server with its own DNS caching, so that I could query Spamhaus's servers. Whoops! I would have never guessed that DNS had anything to do with it.

Hopefully this info will help anyone who is having similar problems.

9 Reply by ZhangHuangbin

  • ZhangHuangbin
  • ZhangHuangbin
  • iRedMail Developers
  • Offline
  • Registered: 2009-05-06
  • Posts: 30,770

Re: Amavis+Spamassassin+reject_rbl_client = SPAM

Thanks for sharing. I updated our tutorial to recommend to setup a local DNS server:
http://www.iredmail.org/docs/enable.dnsbl.html