How to harden spam detection

[Kan]

Hello,

I see there are 2 parameters I can modify :
- Backscatter score (default value : 0)
- Heuristic score (default value : 3)

How should I modify these parameters to harden filters ? Thx

 

[Kan]

Any help please ?

 

[DerDanilo]

I am also interessted in this.

 

[ChFin]

Backscatter Score x sets in /etc/mail/spamassassin/local.cf
whitelist_bounce_relays pmg.mydomain.net
score ANY_BOUNCE_MESSAGE x
-> https://wiki.apache.org/spamassassin/VBounceRuleset

 

[Kan]

Ok for bounced mails but the mailgateway i installed does not block a good percentage of spam. Some mails are pure spam and it passes through filters. How can I have filters more strict ?

 

[ChFin]

What DNS server are you using?

 

[Kan]

What DNS server are you using?

I use google 8.8.8.8

 

[ChFin]

With a public DNS u hardly detect any spam. Use a DNS resolver (bind)
https://forum.proxmox.com/threads/how-to-local-dns-resolver-for-proxmox-mail-gateway.41189/

 

[tom]

I use google 8.8.8.8

NEVER use a DNS like 8.8.8.8 (or similar) if you want access to DNSBL

 

[DerDanilo]

I use the closest DNS available. Hetzner DNS servers since the ded hosts are running with their networks.

 

[ChFin]

use your own DNS resolver - Hetzner does not work

EDIT: (the first 3 are Hetzner DNS Server)
# dig +short @213.133.98.98 2.0.0.127.zen.spamhaus.org
# dig +short @213.133.99.99 2.0.0.127.zen.spamhaus.org
# dig +short @213.133.100.100 2.0.0.127.zen.spamhaus.org
# dig +short @mylocaldns 2.0.0.127.zen.spamhaus.org
127.0.0.4
127.0.0.10
127.0.0.2

# dig +short txt @213.133.98.98 2.0.0.127.zen.spamhaus.org
# dig +short txt @127.0.0.1 2.0.0.127.zen.spamhaus.org
"https://www.spamhaus.org/sbl/query/SBL2"
"https://www.spamhaus.org/query/ip/127.0.0.2"

 

[Kan]

use your own DNS resolver - Hetzner does not work

EDIT: (the first 3 are Hetzner DNS Server)
# dig +short @213.133.98.98 2.0.0.127.zen.spamhaus.org
# dig +short @213.133.99.99 2.0.0.127.zen.spamhaus.org
# dig +short @213.133.100.100 2.0.0.127.zen.spamhaus.org
# dig +short @mylocaldns 2.0.0.127.zen.spamhaus.org
127.0.0.4
127.0.0.10
127.0.0.2

# dig +short txt @213.133.98.98 2.0.0.127.zen.spamhaus.org
# dig +short txt @127.0.0.1 2.0.0.127.zen.spamhaus.org
"https://www.spamhaus.org/sbl/query/SBL2"
"https://www.spamhaus.org/query/ip/127.0.0.2"

I don't understand your message. Can you explain it please ?

I've just installed bind on the PMG server as you suggested (and Tom). What should I do next ?

 

[ChFin]

I don't understand your message. Can you explain it please ?

That was just to show that Hetzner DNS does not work with (Spamhaus) DNSBL in response to @DerDanilo message.

If you have installed and configured bind as I explained than you are ok. The mailgateway should now detect the spam.

This commands should always return the IP of your local DNS:
# dig o-o.myaddr.l.google.com -t txt +short
# dig -t a whoami.v4.powerdns.org +short
# dig -t txt whoami.v4.powerdns.org +short
# dig -t txt whoami-ecs.v4.powerdns.org +short
# dig -t a whoami.akamai.net +short

Test/Result with Spamhaus:
# dig +short 2.0.0.127.zen.spamhaus.org
127.0.0.4
127.0.0.10
127.0.0.2

Test/Result with URIBL
# host -tTXT 2.0.0.127.multi.uribl.com
2.0.0.127.multi.uribl.com descriptive text "permanent testpoint"

 

[Kan]

Today morning I've got more spams than yesterday (after installing bind as suggested)

How can I verify if the server really checks DNSBL ?

 

[ChFin]

Today morning I've got more spams than yesterday (after installing bind as suggested)

How can I verify if the server really checks DNSBL ?

What is the output of the test commands above? (if "dig" is not available install the dnsutils package with "apt-get install dnsutils")
Do you have any URIBL_BLOCKED in your mail.log since you changed your dns?

 

[Kan]

What is the output of the test commands above? (if "dig" is not available install the dnsutils package with "apt-get install dnsutils")
Do you have any URIBL_BLOCKED in your mail.log since you changed your dns?

The dig command returns exactly what you described in your post. I think this is OK.

I have a lot of lines like this one in mail.log BEFORE bind install :

Feb 26 16:36:00 mailgateway pmg-smtp-filter[1792]: 2226B55A94295F9DB40: SA score=3/5 time=0.651 bayes=undefined autolearn=no autolearn_force=no hits=DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,HTML_IMAGE_RATIO_02,HTML_MESSAGE,JMQ_SPF_NEUTRAL_ALL,KAM_HTMLNOISE,RDNS_NONE,SPF_PASS,T_REMOTE_IMAGE,URIBL_BLOCKED

But none after.

Is there any others parameters to modify ?

 

[ChFin]

Is there any others parameters to modify ?

Configuration->Spam Detector -> Use RBL checks "Yes"