What improvements can be made for spam detection?

[ndonkersloot]

We are running Proxmox Mail Gateway for some time now but recently more spam is getting through then usual.
Even very obvious spam does not get scored as such. What improvements can be made to improve spam detection?

We've manually configured Pyzor and DCC and use spamhaus and spamcop as DNSBL sites.

See this mail for example:

Which get's processed as such:

postfix/smtpd[2327220]: connect from mail.tomolax.pridal.name[37.48.67.247]
postfix/smtpd[2327220]: 8FCDDE376B: client=mail.tomolax.pridal.name[37.48.67.247]
postfix/cleanup[2338354]: 8FCDDE376B: message-id=<616286876465643310454155566553711584634766744064@tusale.pro>
postfix/qmgr[1034301]: 8FCDDE376B: from=<urbamqc@tusale.pro>, size=31212, nrcpt=1 (queue active)
postfix/smtpd[2327220]: disconnect from mail.tomolax.pridal.name[37.48.67.247] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
pmg-smtp-filter[2338456]: 127C676759B5689DC00: new mail message-id=<616286876465643310454155566553711584634766744064@tusale.pro>#012
pmg-smtp-filter[2338456]: 127C676759B5689DC00: SA score=2/5 time=5.116 bayes=0.00 autolearn=no autolearn_force=no hits=DMARC_MISSING(0.1),HTML_IMAGE_ONLY_32(0.001),HTML_MESSAGE(0.001),KAM_DMARC_STATUS(0.01),MIXED_HREF_CASE(2.5),SPF_HELO_NONE(0.25),SPF_PASS(-0.001),T_TVD_MIME_EPI(0.01)
pmg-smtp-filter[2338456]: 127C676759B5689DC00: accept mail to <redacted> (CD39EE3678) (rule: default-accept)
pmg-smtp-filter[2338456]: 127C676759B5689DC00: processing time: 5.239 seconds (5.116, 0.036, 0)
postfix/lmtp[2326954]: 8FCDDE376B: to=<redacted>, relay=127.0.0.1[127.0.0.1]:10024, delay=5.4, delays=0.07/0/0.04/5.2, dsn=2.5.0, status=sent (250 2.5.0 OK (127C676759B5689DC00))
postfix/qmgr[1034301]: 8FCDDE376B: removed

Maybe we need a good dutch spamassasin ruleset?

 

[Stoiko Ivanov]

As a simple first step - I'd recommend going through the getting started article:
https://pmg.proxmox.com/wiki/index.php/Getting_started_with_Proxmox_Mail_Gateway
(and all its linked pages)

The logs don't indicate anything that would show direct issues that lead to a simple solution though... (IP is not listed at any of the widely used DNSBLs)

out of curiosity and a suggestion we might add (or simply change the code in the future) - make sure your max spam size is set as large as your maximal general e-mail size

 

[olluz]

If you want to improve the DNSBL detection it's worth comparing the various providers, e.g. here
For my spam messages DRONEBL and UCEPROTECT seem to work best.

You might also want to give different weights for the DNSBL queries, like so:
dnsbl-1.uceprotect.net*4; dnsbl-2.uceprotect.net*4; dnsbl.dronebl.org*3;....
.... and tweak the DNSBL Threshold accordingly

 

[maenda]

If you want to improve the DNSBL detection it's worth comparing the various providers, e.g. here
For my spam messages DRONEBL and UCEPROTECT seem to work best.

You might also want to give different weights for the DNSBL queries, like so:
dnsbl-1.uceprotect.net*4; dnsbl-2.uceprotect.net*4; dnsbl.dronebl.org*3;....
.... and tweak the DNSBL Threshold accordingly

Is dnsbl-2.uceprotect.net*4 not too aggressive with lots of false positives due to blocking complete subnets?