Mailscanner - large deployment

Paulo Roncon paulo-m-roncon at ptinovacao.pt
Thu Nov 20 14:52:47 GMT 2008


Hello,

I'm thinking on building a farm of servers with mailscanner. My question is related to the quarantine mantainance: Should i implement a shared médium to store the files, or should every server in the farm have its on quarantine directory?
This is important because i need to implement a way to inform the users that there's quarantined email, and its location.
I'm thinking of mailscanner + sendmail + mailwatch

Can you please advise?

Paulo Sergio
Portugal Telecom


-----Original Message-----
From: mailscanner-bounces at lists.mailscanner.info [mailto:mailscanner-bounces at lists.mailscanner.info] On Behalf Of mailscanner-request at lists.mailscanner.info
Sent: quinta-feira, 20 de Novembro de 2008 12:02
To: mailscanner at lists.mailscanner.info
Subject: MailScanner Digest, Vol 35, Issue 26

Send MailScanner mailing list submissions to
        mailscanner at lists.mailscanner.info

To subscribe or unsubscribe via the World Wide Web, visit
        http://lists.mailscanner.info/mailman/listinfo/mailscanner
or, via email, send a message with subject or body 'help' to
        mailscanner-request at lists.mailscanner.info

You can reach the person managing the list at
        mailscanner-owner at lists.mailscanner.info

When replying, please edit your Subject line so it is more specific
than "Re: Contents of MailScanner digest..."


Today's Topics:

   1. Cannot find Socket (/tmp/clamd) (Rick Duval)
   2. Re: MailScanner's /usr/sbin/update_spammassassin doesn't
      restart   spamd (Mark Sapiro)
   3. Re: Cannot find Socket (/tmp/clamd) (Martin Hepworth)
   4. RE: Cannot find Socket (/tmp/clamd) (Stef Morrell)
   5. Re: Cannot find Socket (/tmp/clamd) (Martin Hepworth)
   6. Re: Cannot find Socket (/tmp/clamd) (Eduardo Casarero)
   7. RE: Message rules don't work, but if message forwarded, it
      does??? (Chris Barber)
   8. Re: MailScanner's /usr/sbin/update_spammassassin doesn't
      restart   spamd (Kai Schaetzl)
   9. RE: Cannot find Socket (/tmp/clamd) (Stef Morrell)
  10. Re: Message rules don't work, but if message forwarded, it
      does??? (Scott Silva)
  11. RE: Message rules don't work, but if message forwarded, it
      does??? (Chris Barber)
  12. How to test RBL lookups in MailScanner? (Chris Barber)
  13. Re: How to test RBL lookups in MailScanner? (Martin Hepworth)


----------------------------------------------------------------------

Message: 1
Date: Wed, 19 Nov 2008 10:45:32 -0500
From: "Rick Duval" <rick at duvals.ca>
Subject: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <4baa40ce0811190745t4367c707na3d62a864f8b1e65 at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

Tailing the maillog I get

Cannot find Socket (/tmp/clamd) Exiting!

I'm using MailSCanner 4.68.8

Can someone help me with this?

THanks


------------------------------

Message: 2
Date: Wed, 19 Nov 2008 07:46:55 -0800
From: Mark Sapiro <mark at msapiro.net>
Subject: Re: MailScanner's /usr/sbin/update_spammassassin doesn't
        restart spamd
To: MailScanner discussion <mailscanner at lists.mailscanner.info>
Message-ID: <20081119154655.GA412 at msapiro>
Content-Type: text/plain; charset=us-ascii

On Tue, Nov 18, 2008 at 11:31:21PM +0100, Kai Schaetzl wrote:
> Mark Sapiro wrote on Tue, 18 Nov 2008 08:29:45 -0800:
>
> > It does the sa-compile if you have an uncommented
> >
> > loadplugin Mail::SpamAssassin::Plugin::Rule2XSBody
> >
> > in /etc/mail/spamassassin/*pre
>
> I don't see this. Where's your knowledge from?
>


The following in /usr/sbin/update_spamassassin

# If we have sa-compile and they are using the Rule2XSBody plugin then compile
if test -x $SACOMPILE && grep -q '^loadplugin.*Rule2XSBody' /etc/mail/spamassassin/*pre 2>/dev/null ; then
  $SACOMPILE >>$LOGFILE 2>&1
fi

--
Mark Sapiro mark at msapiro net       The highway is for gamblers,
San Francisco Bay Area, California    better use your sense - B. Dylan


------------------------------

Message: 3
Date: Wed, 19 Nov 2008 16:18:25 +0000
From: "Martin Hepworth" <maxsec at gmail.com>
Subject: Re: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <72cf361e0811190818n715716e5q4808999a66ed3746 at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

2008/11/19 Rick Duval <rick at duvals.ca>:
> Tailing the maillog I get
>
> Cannot find Socket (/tmp/clamd) Exiting!
>
> I'm using MailSCanner 4.68.8
>
> Can someone help me with this?
>
> THanks
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>


Hi
check your clamd setup (clamd.conf) has the socket in the same
location as you've defined in MailScanner.conf

--
Martin Hepworth
Oxford, UK


------------------------------

Message: 4
Date: Wed, 19 Nov 2008 16:21:32 -0000
From: "Stef Morrell" <stef at aoc-uk.com>
Subject: RE: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID: <200811191621.mAJGLYDi018166 at safir.blacknight.ie>
Content-Type: text/plain;       charset="us-ascii"

Rick Duval wrote:
> Tailing the maillog I get
>
> Cannot find Socket (/tmp/clamd) Exiting!
>
> I'm using MailSCanner 4.68.8
>
> Can someone help me with this?

You need to ensure that the settings in MailScanner.conf:

# Clamd only: configuration options for using the clamd daemon.
# 1. The port to use when communicating with clamd via TCP connection
# 2. The Socket, or IP to use for communicating with the clamd Daemon.
#    You enter either the full path to the UNIX socket file or the IP
#    address the daemon is listening on.
# 3. The ClamD Lock file should be created by clamd init script in most
#    cases. If it is not then the entry should be blank.
# 4. If MailScanner is running on a system with more then 1 CPU core (or
#    more than 1 CPU) then you can set "Clamd Use Threads" to "yes" to
#    speed up the scanning, otherwise there is no advantage and it
should
#    be set to "no".
#
# None of these options can be the filenames of rulesets, they must be
just
# simple values.
Clamd Port = 3310
Clamd Socket = /tmp/clamd

Are the same as the settings in clamd.conf:

# Path to a local socket file the daemon will listen on.
# Default: disabled
LocalSocket /tmp/clamd

Regards

Stef
--
Stefan Morrell          | Operations Director
Tel: 0845 3452820       | Alpha Omega Computers Ltd
Fax: 0845 3452830       | Incorporating Level 5 Internet
stef at aoc-uk.com         | stef at l5net.net

Standard Disclaimer: http://www.aoc-uk.com/16.asp

Alpha Omega Computers Ltd, Unit 57, BBTC, Grange Road, Batley, WF17 6ER.
Registered in England No. 3867142.  VAT No. GB734421454


------------------------------

Message: 5
Date: Wed, 19 Nov 2008 16:28:51 +0000
From: "Martin Hepworth" <maxsec at gmail.com>
Subject: Re: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <72cf361e0811190828j529f3d2bm872e0048010ec5cc at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

2008/11/19 Stef Morrell <stef at aoc-uk.com>:
> Rick Duval wrote:
>> Tailing the maillog I get
>>
>> Cannot find Socket (/tmp/clamd) Exiting!
>>
>> I'm using MailSCanner 4.68.8
>>
>> Can someone help me with this?
>
> You need to ensure that the settings in MailScanner.conf:
>
> # Clamd only: configuration options for using the clamd daemon.
> # 1. The port to use when communicating with clamd via TCP connection
> # 2. The Socket, or IP to use for communicating with the clamd Daemon.
> #    You enter either the full path to the UNIX socket file or the IP
> #    address the daemon is listening on.
> # 3. The ClamD Lock file should be created by clamd init script in most
> #    cases. If it is not then the entry should be blank.
> # 4. If MailScanner is running on a system with more then 1 CPU core (or
> #    more than 1 CPU) then you can set "Clamd Use Threads" to "yes" to
> #    speed up the scanning, otherwise there is no advantage and it
> should
> #    be set to "no".
> #
> # None of these options can be the filenames of rulesets, they must be
> just
> # simple values.
> Clamd Port = 3310
> Clamd Socket = /tmp/clamd
>
> Are the same as the settings in clamd.conf:
>
> # Path to a local socket file the daemon will listen on.
> # Default: disabled
> LocalSocket /tmp/clamd
>
> Regards
>
> Stef
> --
> Stefan Morrell          | Operations Director
> Tel: 0845 3452820       | Alpha Omega Computers Ltd
> Fax: 0845 3452830       | Incorporating Level 5 Internet
> stef at aoc-uk.com         | stef at l5net.net
>
> Standard Disclaimer: http://www.aoc-uk.com/16.asp
>
> Alpha Omega Computers Ltd, Unit 57, BBTC, Grange Road, Batley, WF17 6ER.
> Registered in England No. 3867142.  VAT No. GB734421454
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>


Stef
and you're running clamd as what user? and is this user is consistent
with what you've got setup in MailScanner.conf?

--
Martin Hepworth
Oxford, UK


------------------------------

Message: 6
Date: Wed, 19 Nov 2008 15:05:40 -0200
From: "Eduardo Casarero" <ecasarero at gmail.com>
Subject: Re: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <7d9b3cf20811190905x7fbddebdp1204be1587074cc6 at mail.gmail.com>
Content-Type: text/plain; charset="iso-8859-1"

some clamav installations put the socket in /tmp/clamd.socket by default an
MS config has /tmp/clamd make them match

2008/11/19 Rick Duval <rick at duvals.ca>

> Tailing the maillog I get
>
> Cannot find Socket (/tmp/clamd) Exiting!
>
> I'm using MailSCanner 4.68.8
>
> Can someone help me with this?
>
> THanks
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081119/b33c3f8b/attachment-0001.html

------------------------------

Message: 7
Date: Wed, 19 Nov 2008 12:08:37 -0500
From: "Chris Barber" <cbarber at techquility.net>
Subject: RE: Message rules don't work, but if message forwarded, it
        does???
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <43F62CA225017044BC84CFAF92B4333B036074 at sbsserver.Techquility.net>
Content-Type: text/plain;       charset="us-ascii"

2008/11/6 Chris Barber <cbarber at techquility.net>:
>>
>>
>> Glenn,
>>
>> Thanks for the reply. You had me scared for a second there, but no
> there
>> was no white listing going on. I verified the envelope addresses.
This
>> issue seems to happen randomly a least a couple times a day to some
>> users.
>>
>> Any other ideas?
>>
>> Thanks,
>> Chris
>>
>>Didn't mean to scare you, just point at one (semi-obvious:-)
> possibility....:-)
>>When it happens do you see anything ... curious .... in the logs?
>>Nothing about "Unscanned" messages or timeouts or suchlike?
>>Also... Tell a bit about versions etc, since this just might be a
>>known bug/issue...
>>
>>Cheers
>>--
>>-- Glenn
>>email: glenn < dot > steen < at > gmail < dot > com
>>work: glenn < dot > steen < at > ap1 < dot > se
>
>
> I don't see anything unusual in the logs. No timeouts and nothing
about
> unscanned that I can see. MailScanner processes the message normally
it
> seems.
>
> It gets an SA score, but the only rules that hit are:
> 0.10 BAYES_50 Bayesian spam probability is 40 to 60%
> 0.00 HTML_MESSAGE HTML included in message
> -0.00 SPF_PASS SPF: sender matches SPF record
>
> Then when the same message is forwarded to me from the user, (Through
> the same MailScanner server) the rule hits show:
> -0.74 BAYES_20 Bayesian spam probability is 5 to 20%
> 0.00 HTML_MESSAGE HTML included in message
> 2.96 URIBL_BLACK Contains an URL listed in the URIBL blacklist
> 3.50 URIBL_OB_SURBL Contains an URL listed in the OB SURBL blocklist
>
> Notice that now the URL is beting detected, but why not before?
>
> Versions:
> Cent OS 5.2
> MailScanner 4.72.5
> Spamassassin 3.2.5
> Perl 5.8.8
> MIME::Tools 5.427
> HTML::Parser 3.56
>
> Let me know if there are versions of anything else you would like to
see
>
> Thanks!
> Chris
>
>Could perhaps be a "timing issue"....:-)
>Meaning the URI wasn't in the BL when MS first asked... but when the
>user resent it to you.... the BL had been updated. These things have a
>tendency to be really short-lived and ... bursty... so if there is any
>somewhat significant amount of time between the initial mail and the
>user forwarding it to you... say a few hours... that might explain it
>all.
>In which case... all is well ...:-)
>
>Cheers
>--
>-- Glenn
>email: glenn < dot > steen < at > gmail < dot > com
>work: glenn < dot > steen < at > ap1 < dot > se

I agree that this timing issue is probably the cause for some of these.
However there are many of these for one of my users almost every day. I
have her forwarding them to me right after she gets them and they are
blocked.

Scott mentioned running MailScanner --lint, MailScanner --debug
--debug-sa
I did this and I don't see any errors. I can see the URI_OB_SURBL rule
(for example) run and successfully score the message. Is it possible
that this is timing out sometimes? I have not seen a timeout but I am
grasping at straws at this point to figure out why the URL in the
message seems to be ignored the first time, then 5 min later when the
message is forwarded back to me (Going through the same MailScanner
server), it gets caught?

Thanks,
Chris



------------------------------

Message: 8
Date: Wed, 19 Nov 2008 18:31:19 +0100
From: Kai Schaetzl <maillists at conactive.com>
Subject: Re: MailScanner's /usr/sbin/update_spammassassin doesn't
        restart spamd
To: mailscanner at lists.mailscanner.info
Message-ID: <VA.00003490.25a623f3 at news.conactive.com>
Content-Type: text/plain; charset=iso-8859-1

Mark Sapiro wrote on Wed, 19 Nov 2008 07:46:55 -0800:

> The following in /usr/sbin/update_spamassassin

Oh, I missed that part in your original message. I have an old version of
that script in /etc/cron.daily which lacks this section and was assuming
you meant to say that sa-update itself is compiling after the download.
Thanks for reminding me of that location.

Kai

--
Kai Sch?tzl, Berlin, Germany
Get your web at Conactive Internet Services: http://www.conactive.com





------------------------------

Message: 9
Date: Wed, 19 Nov 2008 17:39:27 -0000
From: "Stef Morrell" <stef at aoc-uk.com>
Subject: RE: Cannot find Socket (/tmp/clamd)
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID: <200811191739.mAJHdU2f020719 at safir.blacknight.ie>
Content-Type: text/plain;       charset="us-ascii"

Martin Hepworth wrote:
> 2008/11/19 Stef Morrell <stef at aoc-uk.com>:
>> Rick Duval wrote:
>>> Tailing the maillog I get
>>>
>>> Cannot find Socket (/tmp/clamd) Exiting!
>>>
>>> I'm using MailSCanner 4.68.8
>>>
>>> Can someone help me with this?
>>
>> You need to ensure that the settings in MailScanner.conf:
>>
<snip examples from conf files>
>
> Stef
> and you're running clamd as what user? and is this user is
> consistent with what you've got setup in MailScanner.conf?
>

Martin - I'm confused. I was trying to answer Rick's question. Looks
like we pressed "send" fairly well at the same time. My setup is working
just fine :)

Seeing as you ask, I suspect clamd is running as root. I installed it
from Jules' SA+Clam then added a start stop script into /etc/rc.
Possibly not the most secure, but as I have no local users to exploit
it, I don't much care. MailScanner runs as Postfix.

Stef
--
Stefan Morrell          | Operations Director
Tel: 0845 3452820       | Alpha Omega Computers Ltd
Fax: 0845 3452830       | Incorporating Level 5 Internet
stef at aoc-uk.com         | stef at l5net.net

Standard Disclaimer: http://www.aoc-uk.com/16.asp

Alpha Omega Computers Ltd, Unit 57, BBTC, Grange Road, Batley, WF17 6ER.
Registered in England No. 3867142.  VAT No. GB734421454


------------------------------

Message: 10
Date: Wed, 19 Nov 2008 12:05:12 -0800
From: Scott Silva <ssilva at sgvwater.com>
Subject: Re: Message rules don't work, but if message forwarded, it
        does???
To: mailscanner at lists.mailscanner.info
Message-ID: <gg1rhp$rfn$1 at ger.gmane.org>
Content-Type: text/plain; charset="utf-8"

<snip>
> I agree that this timing issue is probably the cause for some of these.
> However there are many of these for one of my users almost every day. I
> have her forwarding them to me right after she gets them and they are
> blocked.
>
> Scott mentioned running MailScanner --lint, MailScanner --debug
> --debug-sa
> I did this and I don't see any errors. I can see the URI_OB_SURBL rule
> (for example) run and successfully score the message. Is it possible
> that this is timing out sometimes? I have not seen a timeout but I am
> grasping at straws at this point to figure out why the URL in the
> message seems to be ignored the first time, then 5 min later when the
> message is forwarded back to me (Going through the same MailScanner
> server), it gets caught?
>
> Thanks,
> Chris
>
Is the server natted? Does it have a real public IP address or is it port
forwarded from another server?

Can you follow the chain of the headers back on both a missed message and
after it has been forwarded to you?

I am still leaning toward this being some sort of trust path issue in
spamassassin, although it could be a net timeout. The lookup might time out
just before the result comes back, and on the resend the lookup is in the
local cache and hits. Have you tried setting your spammassassin timeouts longer?

Do you have any full examples of a missed message, and one that hits right
afterwards? Either full queue files or complete RFC 822 (2822) messages.


--
MailScanner is like deodorant...
You hope everybody uses it, and
you notice quickly if they don't!!!!

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 250 bytes
Desc: OpenPGP digital signature
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081119/e8082a6c/signature-0001.bin

------------------------------

Message: 11
Date: Wed, 19 Nov 2008 20:20:21 -0500
From: "Chris Barber" <cbarber at techquility.net>
Subject: RE: Message rules don't work, but if message forwarded, it
        does???
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <43F62CA225017044BC84CFAF92B4333B03607E at sbsserver.Techquility.net>
Content-Type: text/plain; charset="utf-8"


<snip>
> I agree that this timing issue is probably the cause for some of these.
> However there are many of these for one of my users almost every day.
> I have her forwarding them to me right after she gets them and they
> are blocked.
>
> Scott mentioned running MailScanner --lint, MailScanner --debug
> --debug-sa I did this and I don't see any errors. I can see the
> URI_OB_SURBL rule (for example) run and successfully score the
> message. Is it possible that this is timing out sometimes? I have not
> seen a timeout but I am grasping at straws at this point to figure out
> why the URL in the message seems to be ignored the first time, then 5
> min later when the message is forwarded back to me (Going through the
> same MailScanner server), it gets caught?
>
> Thanks,
> Chris
>
>Is the server natted? Does it have a real public IP address or is it port forwarded from another server?
>
>Can you follow the chain of the headers back on both a missed message and after it has been forwarded to you?
>
>I am still leaning toward this being some sort of trust path issue in spamassassin, although it could be a net timeout. The lookup might time out >just before the result comes back, and on the resend the lookup is in the local cache and hits. Have you tried setting your spammassassin timeouts >longer?
>
>Do you have any full examples of a missed message, and one that hits right afterwards? Either full queue files or complete RFC 822 (2822) messages.

Thanks for the reply.

Yes this server is natted behind a Cisco ASA. Port 25 is forwarded to the MailScanner machine. Out of curiosity, where are you headed with this question?

I followed the headers and it looks correct. I can see the message travel to my MailScanner server and then on to the customers mail server. On the forwarded message, I see it go from the customers mail server directly to my MailScanner server and then on to my internal mail server. Is this what you mean by follow the chain?

I actually have increased my Spamassassin timeout to 120 seconds. Is there some other type of timeout I should/could be watching for?

I've attached the message queue files and named them accordingly. Let me know if this is not the format you requested.

Thanks again for the assistance!
Chris
-------------- next part --------------
A non-text attachment was scrubbed...
Name: messages.tar
Type: application/x-tar
Size: 9728 bytes
Desc: messages.tar
Url : http://lists.mailscanner.info/pipermail/mailscanner/attachments/20081119/95657bb8/messages-0001.tar

------------------------------

Message: 12
Date: Wed, 19 Nov 2008 20:26:50 -0500
From: "Chris Barber" <cbarber at techquility.net>
Subject: How to test RBL lookups in MailScanner?
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <43F62CA225017044BC84CFAF92B4333B03607F at sbsserver.Techquility.net>
Content-Type: text/plain;       charset="utf-8"

Hi All,

This might be obvious and I apologize in advance, but how can I test if MailScanner is testing messages for RBL (Spam List)? I tried running MailScanner --debug --debug-sa and I don't see anything about it, unless I'm missing something.

I normally have my MTA do RBL lookups but there are a few other lists I want to try out. I don't want to try a new list on the MTA since it outright rejects messages that hit the lists. For testing purposes, I want MailScanner to check these other RBL's and then quarantine the message. My users can then release the message if it is a false positive. Once satisfied with a list choice, I'll then move it to the MTA.

Running MailScanner version 4.72.5
I have enabled the Spam List option and I populated the spam.lists.conf file with the new RBL I want to test.

Thanks,
Chris

------------------------------

Message: 13
Date: Thu, 20 Nov 2008 09:25:46 +0000
From: "Martin Hepworth" <maxsec at gmail.com>
Subject: Re: How to test RBL lookups in MailScanner?
To: "MailScanner discussion" <mailscanner at lists.mailscanner.info>
Message-ID:
        <72cf361e0811200125u3499ac00x3f7e979ff42df4d8 at mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1

2008/11/20 Chris Barber <cbarber at techquility.net>:
> Hi All,
>
> This might be obvious and I apologize in advance, but how can I test if MailScanner is testing messages for RBL (Spam List)? I tried running MailScanner --debug --debug-sa and I don't see anything about it, unless I'm missing something.
>
> I normally have my MTA do RBL lookups but there are a few other lists I want to try out. I don't want to try a new list on the MTA since it outright rejects messages that hit the lists. For testing purposes, I want MailScanner to check these other RBL's and then quarantine the message. My users can then release the message if it is a false positive. Once satisfied with a list choice, I'll then move it to the MTA.
>
> Running MailScanner version 4.72.5
> I have enabled the Spam List option and I populated the spam.lists.conf file with the new RBL I want to test.
>
> Thanks,
> Chris
>
> --
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
> Before posting, read http://wiki.mailscanner.info/posting
>
> Support MailScanner development - buy the book off the website!
>
>


I find the best way to do the RBL's in spamassassin, they way it adds
to the score. You can you multiple RBLs in mailscanner and then say it
must at least 2 before it's marked as spam, but I prefer the
spamassassin way.

--
Martin Hepworth
Oxford, UK


------------------------------

--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner

Before posting, read the Wiki (http://wiki.mailscanner.info/).

Support MailScanner development - buy the book off the website!


End of MailScanner Digest, Vol 35, Issue 26
*******************************************


More information about the MailScanner mailing list