Spamerkennung schlecht, trotz Anlernens. Weitere Dienste buchen?

S

Speedy

New Member
Proxmox Subscriber
Apr 19, 2023
8
1
3
Hallo,

ich nutze Proxmox jetzt seit ca. 2 Jahren und kann nicht sagen, dass es wesentlich zur Spamreduzierung beigetragen hat. Die Standard-Config meiner Keyhelp Server sind genauso gut/schlecht. Ich lerne regelmäßgig Spam Mails an, dennoch werden bspw. "Hondrofr*st", "Artro*ux" etc., welches mindestens schon 200x angelernt wurde durchgelassen.
Ich hatte auch mal die kostenpflichtige spamhaus Version eingebunden. Naja, etwas besser, aber auch nicht der große Wurf. Das mal Mails durchkommen, ok. Aber ganz klarer Spam und immer wiederkehrender "Müll" muss doch beseitigt werden können.

Welche (kostenpflichtigen) Listen gibt es noch? So macht das Proxmox Abo irgendwie keinen Sinn, wenn ich keinen Mehrwert dadurch habe.

Das sind meine Liste: zen.spamhaus.org*2,bl.spamcop.net,psbl.surriel.com,spamrbl.imp.ch,noptr.spamrats.com,bl.score.senderscore.com,bl.spameatingmonkey.net,dnsbl.dronebl.org,ix.dnsbl.manitu.net,b.barracudacentral.org,truncate.gbudb.net,bl.blocklist.de,ws.surbl.org,multi.surbl.org

Vielen Dank.
 
Danke. DNS Resolver hatte ich vor einiger Zeit schon eingerichet.

Code: 
From: "Artrolux" <awdivzt@vinskony.de>
To: <klaus.walther@domain.de>
Subject: Wiederherstellung der Gelenke in nur 1 Kur
Date: Tue, 17 Dec 2024 21:50:55 +0200
MIME-Version: 1.0
Content-Type: multipart/related;
    type="multipart/alternative";
    boundary="----=_NextPart_000_0018_01DB50CB.D08D35A0"
X-SPAM-LEVEL: Spam detection results:  2
    AWL                    -0.001 Adjusted score from AWL reputation of From: address
    BAYES_50                  0.8 Bayes spam probability is 40 to 60%
    HTML_IMAGE_ONLY_32      0.001 HTML: images with 2800-3200 bytes of words
    HTML_IMAGE_RATIO_08     0.001 HTML has a low ratio of text to image area
    HTML_MESSAGE            0.001 HTML included in message
    KAM_DMARC_STATUS         0.01 Test Rule for DKIM or SPF Failure with Strict Alignment
    PDS_OTHER_BAD_TLD       1.997 Untrustworthy TLDs
    SPF_FAIL                0.001 SPF: sender does not match SPF record (fail)
    SPF_HELO_NONE           0.001 SPF: HELO does not publish an SPF Record
    T_TVD_MIME_EPI           0.01 -
 
die Logs werden im Tracking Center angezeigt - aber die header helfen auch schon mal...
Speedy said:
AWL -0.001 Adjusted score from AWL reputation of From: address
Click to expand...
auto whitelist würde ich potentiell abdrehen.

je nach allgemeinen Mail-aufkommen, vl. auch ein wenig den score von:
Speedy said:
PDS_OTHER_BAD_TLD 1.997 Untrustworthy TLDs
Click to expand...
hochdrehen.

und last but not least - auch wenn es zu false positives führen kann, kann ab und zu eine Match Subject rule mit quarantine/Block auch eine option sein
("Wiederherstellung der Gelenke")
 
Danke für die weiterführenden Tipps.

Hier das Log:
Code: 
2024-12-18T02:45:42.742634+01:00 mx1 postfix/smtpd[133520]: connect from mail.tupot.gb.net[85.25.194.150]
2024-12-18T02:45:42.875390+01:00 mx1 postfix/smtpd[133520]: D599C60D61: client=mail.tupot.gb.net[85.25.194.150]
2024-12-18T02:45:42.886714+01:00 mx1 postfix/cleanup[133525]: D599C60D61: message-id=<200577378702353760183176055103856644681675333183@vinskony.de>
2024-12-18T02:45:42.914080+01:00 mx1 postfix/smtpd[133520]: disconnect from mail.tupot.gb.net[85.25.194.150] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
2024-12-18T02:45:42.914822+01:00 mx1 postfix/qmgr[54559]: D599C60D61: from=<awdivzt@vinskony.de>, size=58424, nrcpt=1 (queue active)
2024-12-18T02:45:43.051828+01:00 mx1 pmg-smtp-filter[131539]: 60D696762294707A81: new mail message-id=<200577378702353760183176055103856644681675333183@vinskony.de>#012
2024-12-18T02:45:43.811902+01:00 mx1 pmg-smtp-filter[131539]: 60D696762294707A81: SA score=2/5 time=0.664 bayes=0.50 autolearn=no autolearn_force=no hits=BAYES_50(0.8),HTML_IMAGE_ONLY_32(0.001),HTML_IMAGE_RATIO_08(0.001),HTML_MESSAGE(0.001),KAM_DMARC_STATUS(0.01),PDS_OTHER_BAD_TLD(1.997),SPF_HELO_NONE(0.001),SPF_PASS(-0.001),T_TVD_MIME_EPI(0.01)
2024-12-18T02:45:43.829347+01:00 mx1 postfix/smtpd[133531]: connect from localhost.localdomain[127.0.0.1]
2024-12-18T02:45:43.832562+01:00 mx1 postfix/smtpd[133531]: CB32160DD1: client=localhost.localdomain[127.0.0.1], orig_client=mail.tupot.gb.net[85.25.194.150]
2024-12-18T02:45:43.837160+01:00 mx1 postfix/cleanup[133525]: CB32160DD1: message-id=<200577378702353760183176055103856644681675333183@vinskony.de>
2024-12-18T02:45:43.880727+01:00 mx1 postfix/qmgr[54559]: CB32160DD1: from=<awdivzt@vinskony.de>, size=59233, nrcpt=1 (queue active)
2024-12-18T02:45:43.881161+01:00 mx1 pmg-smtp-filter[131539]: 60D696762294707A81: accept mail to <meine@mail.tld> (CB32160DD1) (rule: default-accept)
2024-12-18T02:45:43.881503+01:00 mx1 postfix/smtpd[133531]: disconnect from localhost.localdomain[127.0.0.1] ehlo=1 xforward=1 mail=1 rcpt=1 data=1 commands=5
2024-12-18T02:45:43.897326+01:00 mx1 pmg-smtp-filter[131539]: 60D696762294707A81: processing time: 0.849 seconds (0.664, 0.093, 0)
2024-12-18T02:45:43.898416+01:00 mx1 postfix/lmtp[133526]: D599C60D61: to=<meine@mail.tld>, relay=127.0.0.1[127.0.0.1]:10024, delay=1.1, delays=0.13/0.07/0.04/0.87, dsn=2.5.0, status=sent (250 2.5.0 OK (60D696762294707A81))
2024-12-18T02:45:43.901135+01:00 mx1 postfix/qmgr[54559]: D599C60D61: removed
2024-12-18T02:45:44.651538+01:00 mx1 postfix/smtp[133532]: CB32160DD1: to=<meine@mail.tld>, relay=mx01.meinserver.tld[xx.xx.xx.xx]:25, delay=0.82, delays=0.05/0.08/0.27/0.41, dsn=2.0.0, status=sent (250 2.0.0 Ok: queued as 63FDCE0197)
2024-12-18T02:45:44.652529+01:00 mx1 postfix/qmgr[54559]: CB32160DD1: removed
 
First of all, I noticed that zen.spamhaus.org*2 (or any similar syntax) is no longer functional. When I previously used zen.spamhaus.org on its own, it never triggered any hits. Instead, I recommend using "YOUR_KEY.zen.dq.spamhaus.net", which has proven to be highly effective. In my setup, it successfully blocks approximately 70% of spam emails.

Additionally, I have never observed multi.surbl.org being triggered in my environment.

The primary challenge I still face is phishing emails — though not all of them. The most recent case I encountered bypassed all major blocklists and successfully reached the inbox. It had valid SPF, DKIM, and DMARC records, as well as BIMI (LOL). The SpamAssassin score was only 1/5, solely due to the email being in HTML format.

To further enhance email security, I have started leveraging the built-in Email Filter Security Profile on my FortiGate NGFW in conjunction with PMG. Additionally, I use a blocklist from AbuseIPDB, which I enforce by blocking source IPs directly on the FortiGate NGFW.

As an improvement, I recommend adding bl.mailspike.net to the list of RBLs, as I have found it to be quite effective.

Looking forward to your thoughts.
 
You must log in or register to reply here.
Top Bottom