increase security - Proxmox mail gateway

[stylus]

Hi,
I'm looking to increase the level of email verification (SPAM).
I use proxmox mail gateway with trend micro IMSS ... why ? Proxmox does not block all spam...

For example :

Jul 8 09:01:31 relais postfix/smtpd[28365]: connect from mta6.duwebtresors.fr[37.59.176.109]
Jul 8 09:01:31 relais postfix/smtpd[28365]: 81FA54017A1: client=mta6.duwebtresors.fr[37.59.176.109]
Jul 8 09:01:31 relais postfix/cleanup[28369]: 81FA54017A1: message-id=<1594191684-5f048d15e1594_124567845345AB@duwebtresors.fr>
Jul 8 09:01:31 relais postfix/smtpd[28365]: disconnect from mta6.duwebtresors.fr[37.59.176.109] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Jul 8 09:01:31 relais postfix/qmgr[9673]: 81FA54017A1: from=<bnc-209-5f048d15e1594_124-62@bounce.duwebtresors.fr>, size=31429, nrcpt=1 (queue active)
Jul 8 09:01:31 relais pmg-smtp-filter[27547]: 40196A5F056F4B88BD6: new mail message-id=<1594191684-5f048d15e1594_124567845345AB@duwebtresors.fr>#012
Jul 8 09:01:32 relais pmg-smtp-filter[27547]: 40196A5F056F4B88BD6: SA score=0/5 time=1.094 bayes=undefined autolearn=ham autolearn_force=no hits=AWL(0.580),DKIM_SIGNED(0.1),DKIM_VALID(-0.1),DKIM_VALID_AU(-0.1),DKIM_VALID_EF(-0.1),HTML_FONT_LOW_CONTRAST(0.001),HTML_MESSAGE(0.001),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),URIBL_BLOCKED(0.001)
Jul 8 09:01:32 relais postfix/smtpd[28374]: connect from localhost.localdomain[127.0.0.1]
Jul 8 09:01:32 relais postfix/smtpd[28374]: B6C6A401970: client=localhost.localdomain[127.0.0.1], orig_client=mta6.duwebtresors.fr[37.59.176.109]
Jul 8 09:01:32 relais postfix/cleanup[28369]: B6C6A401970: message-id=<1594191684-5f048d15e1594_124567845345AB@duwebtresors.fr>
Jul 8 09:01:32 relais postfix/qmgr[9673]: B6C6A401970: from=<bnc-209-5f048d15e1594_124-62@bounce.duwebtresors.fr>, size=32717, nrcpt=1 (queue active)
Jul 8 09:01:32 relais pmg-smtp-filter[27547]: 40196A5F056F4B88BD6: accept mail to <E-mail adress> (B6C6A401970) (rule: default-accept)
Jul 8 09:01:32 relais postfix/smtpd[28374]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
Jul 8 09:01:32 relais pmg-smtp-filter[27547]: 40196A5F056F4B88BD6: processing time: 1.234 seconds (1.094, 0.067, 0)
Jul 8 09:01:32 relais postfix/lmtp[28370]: 81FA54017A1: to=<E-mail adress>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.4, delays=0.2/0/0/1.2, dsn=2.5.0, status=sent (250 2.5.0 OK (40196A5F056F4B88BD6))
Jul 8 09:01:32 relais postfix/qmgr[9673]: 81FA54017A1: removed
Jul 8 09:01:33 relais postfix/smtp[28375]: B6C6A401970: to=<E-mail adress>, relay=IP:25, delay=0.26, delays=0.05/0/0.06/0.15, dsn=2.0.0, status=sent (250 OK: <15e3435900000835@domain name>)
Jul 8 09:01:33 relais postfix/qmgr[9673]: B6C6A401970: removed


This email is not blocked by Proxmox
The email has been blocked by IMSS


How to increase the security of Proxmox?

Thx

 

[Stoiko Ivanov]

one thing that is visible in the logs and usually contributes much to bad detection rates is that your DNS-server has reached the rate-limit of uribl:

URIBL_BLOCKED(0.001)

check out our getting started page in the wiki:
https://pmg.proxmox.com/wiki/index....Proxmox_Mail_Gateway#Improving_Spam_Detection

and the guide on setting up a recursive DNS server on your PMG:
https://pmg.proxmox.com/wiki/index.php/DNS_server_on_Proxmox_Mail_Gateway

I hope this helps!

 

[hata_ph]

Might want to share the spam or use spam mail checker to double confirm the spam

https://www.ipqualityscore.com/email-deliverability/email-spam-test-checker/

 

[stylus]

I'll test this
Thank you for your help.