Help with configuration for SPAM mail detection

[ArielVF]

Hello, I am currently performing mail tests to verify the operation of PMG, however I have not had favorable results. There are SPAM emails that are letting them through and it is the email client that blocks them, for example if I send SPAM from a Cpanel email to a Gmail, Gmail detects it as SPAM not PMG.
Based on this, is there an optimal or recommended configuration to apply and perform tests?

Sorry for my English, I'ts not my native language.

 

[Frank666]

have you setup DNSBL Sites under Configuration -> Mail Proxy?
And of course a mail filter rule to modify the subject to spam

 

[Stoiko Ivanov]

I'd recommend implementing the recommendations from the getting started page in our wiki:
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

I hope this helps!

 

[ArielVF]

have you setup DNSBL Sites under Configuration -> Mail Proxy?
And of course a mail filter rule to modify the subject to spam

First of all, thanks for reply.
Yes I do configured the DNSBL, but I don't know what do you mean by the mail filter rule, I'm currently using the default rules that PMG brings (attached photo). In the documentation (From I understood) the default configuration is enpugh for have satisfactory results or, am I missing something else to do?

 

[ArielVF]

I'd recommend implementing the recommendations from the getting started page in our wiki:
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway

I hope this helps!

Thanks for reply.
I have followed the configurations, but the results are not good. I have a lot of undetected spam.

 

[zolthar]

Did you enable the following:


This is what I would configure at a minimum as these are free DNSBL but may need registration:


Also enable "Use SPF"

You "could" do Greylisting, however be cautious implementing that and test thoroughly.

Anything more advanced you will have to tinker with the configs:
https://forum.proxmox.com/threads/a...ly-spam-and-virus-detection.44152/post-211196

Or you could configure the following to improve ClamAV:
https://www.securiteinfo.com/

 

[Stoiko Ivanov]

I have followed the configurations, but the results are not good. I have a lot of undetected spam.

please share:
* the logs of a few mails (especially of ones that are undetected spam)
* the output of `pmgconfig dump`
* the output of `pmgdb dump`

else it's not really possible to see if something can be improved

 

[aquilaxx]

Hi guys!

I also have problem blocking spam like this:


My Rule set look like:



The spam is all coming from O365. Attached pmgconfig-dumb.
pmgdb dump is hard to anonymize

-----------------------------


The header of the mail shown this:
X-SPAM-LEVEL: Spam detection results: 0
DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid
DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature
HTML_MESSAGE 0.001 HTML included in message
KAM_GOOGLE_REDIR 0.5 Message contains a google URL redirector link
RCVD_IN_DNSWL_NONE -0.0001 Sender listed at https://www.dnswl.org/, no trust
RCVD_IN_MSPIKE_H2 -0.001 Average reputation (+2)
SPF_HELO_PASS -0.001 SPF: HELO matches SPF record
SPF_PASS -0.001 SPF: sender matches SPF record
T_SCC_BODY_TEXT_LINE -0.01 -
URIBL_RED 0.001 Contains an URL listed in the URIBL redlist [desirablepopsys.com]
Return-Path: 183920488@s.iukl.edu.my

-----------------------------


Would be cool if anybody can help.