Basic question - lots of spam, what to do?

[kez]

Hi there,

We moved from SpamExperts to PMG some time ago and mostly it works as intended. However, we have seen an influx of spam over the last few months all phishing for mailbox passwords.

I understand you cannot "train/learn" PMG like you can SpamExperts, so is there a way we can manually stop this type of spam?

Example:



Here is the Spam Assisn score log:

Oct 26 01:36:04 mailgate5 pmg-smtp-filter[3930456]: 240A056539B472A1AD8: SA score=0/5 time=2.048 bayes=0.00 autolearn=ham autolearn_force=no hits=ARC_SIGNED(0.001),ARC_VALID(0.001),BAYES_00(-1.9),CBJ_GiveMeABreak(1.75),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DMARC_MISSING(0.1),HTML_FONT_LOW_CONTRAST(0.001),HTML_MESSAGE(0.001),HTML_TAG_BALANCE_HEAD(0.817),KAM_NUMSUBJECT(0.5),RCVD_IN_DNSWL_HI(-5),RCVD_IN_MSPIKE_H2(-0.001),SPF_HELO_PASS(-0.001),SPF_PASS(-0.001),T_KAM_HTML_FONT_INVALID(0.01),T_REMOTE_IMAGE(0.01),URIBL_BLOCKED(0.001)

 

[Stoiko Ivanov]

URIBL_BLOCKED

This would indicate that (at least) your DNS setup is not optimal - check out the getting started page in the pmg-wiki (with all linked articles):
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

especially:
https://pmg.proxmox.com/wiki/index....Proxmox_Mail_Gateway#Improving_Spam_Detection
and the linked page:
https://pmg.proxmox.com/wiki/index.php/DNS_server_on_Proxmox_Mail_Gateway

I hope this helps!

 

[kez]

This would indicate that (at least) your DNS setup is not optimal - check out the getting started page in the pmg-wiki (with all linked articles):
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

especially:
https://pmg.proxmox.com/wiki/index....Proxmox_Mail_Gateway#Improving_Spam_Detection
and the linked page:
https://pmg.proxmox.com/wiki/index.php/DNS_server_on_Proxmox_Mail_Gateway

I hope this helps!

Hi Stoiko,

Thanks for this.

I have installed unbound on each cluster member and am now seeing logs like:

URIBL_GREY(0.424)
URIBL_BLACK(1.7)

So I think it's working better now.

I'll keep an eye on things.

Thanks for the help

 

[Stoiko Ivanov]

So I think it's working better now.

I'll keep an eye on things.

looks better - keep us posted on how it's going!