Proxmox vs efa-project

[kropla]

Hi all
can you help me please ...
i take the test from web page https://docs.libraesva.com/email-security-tester/ to send some spam, virusess
unfortunatelly lot of this mail from this tests are comming to me

i make some comparision with MG of efa-projects -> here even configmration email going to the greylistining on proxmox not, all emails sent (with virusees and spam) also going to greylining list -> on proxmox this mail going directly to the receiver ... even also i havent any exee file in attachment quarantine in proxmox ...
so i think that this proxmox in my sollution is not working ...

i am using pmg version without subscription
thanks for your helping

 

[dcsapak]

can you post the logs from those e-mails? maybe there can be seen why they went through..

 

[kropla]

Sure ..
i attached two files .. first (confirmation.txt -> this is only first mail which i have to clik the link to confirm that i want make the tests). also this mail was greylistining on efa-project -> here going directly to receiver ..
second this is an logs for all sended mails to me (included putty.exe as attachment in this mail) -> proxmox did not blocked it -> i don have anything on attachmant quarantine.
should i make some additional rules ? because currently i have an standard rules ;/

maybye you can share me you own rule (from yours best practice view) ;/ -> unfortunatelly i think that this proxmox dont work correctrly (work but more than i need mails going thru my MG )

 

[Stoiko Ivanov]

one thing that you might improve (and that should help quite a bit in detecting spam) is to configure PMG to use a dedicated DNS resolver:

,URIBL_BLOCKED(0.001)

see : https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway


apart from that the tests (while quite clever) - are not ones which can be caught by PMG in its default rule set e.g.:
* the sender spoofing test (which got blocked for you due to your SPF setup) - having different envelop from and from header information is something that happens quite often also with regular and good mail (e.g. most mailinglists)
* the putty.exe works here with the default rule 'Block Dangerous Files' - Is PMG setup in a way that mails from external (the internet) arrive at the external port of PMG? (defaults to port 25)

I hope this helps!