<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">I’ve used EFA before, but I need to keep this on a SLES server right now, and don’t really have time to figure out how to get EFA to run on it. This is an edge server, but right now it’s behind a relay. I’m testing it behind an existing appliance until I get it ready - so all of the edge processes will need to be added after I turn it live. </div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Does Mailscanner have user or domain level SA config files? I haven’t figured that out yet. I’m getting sick of Portuguese spam, but I have users who receive Portuguese. I get German spam, but I also get real german mail. I also get Spanish spam, and don’t speak Spanish - hehe - but I can’t block any language system-wide or even domain-wide for that matter. </div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Thanks for all of the suggestions. I’m only at about 30% spam blocking right now, and it’s really closer to 80%, so I have to figure out how to tighten it up a bit. </div> <br> <div id="bloop_sign_1483669940239496960" class="bloop_sign"><b>Danita Zanrè</b>, <i>Move Out of the Office</i><div>I love my job, and you can too!</div><div>Tel: (720) 319-7530 - Caledonia Network Consulting</div><div>Tel: (720) 319-8240 - Move Out of the Office</div><div><div><br></div></div></div> <br><p class="airmail_on">On January 5, 2017 at 8:18:33 PM, Dave Jones (<a href="mailto:dave@jonesol.com">dave@jonesol.com</a>) wrote:</p> <blockquote type="cite" class="clean_bq"><span><div><div></div><div>
<title></title>
<div dir="ltr">Definitely setup <a href="http://zen.spamhaus.org" target="_blank">zen.spamhaus.org</a> RBL but this won't help much
unless it's an edge mail server. There are a lot of things
that you can't do at the MTA level unless you are an edge mail
server like HELO checks, DNS PTR checks, RBL checks, greylisting,
etc.
<div>There are ways to make SpamAssassin ignore the relay server by
adding it to internal_networks and trusted_networks but that won't
help the MTA-level checks which are very important. You
should try to block as much as possible at the MTA level so there
will be proper bounce messages. Once the message reaches
MailScanner, then it's basically dropped silently which could be
considered bad.<br>
<div>Download and take a look at the Postfix setup in <a href="https://efa-project.org/" target="_blank">https://efa-project.org/</a> to get some good ideas on how
to tune your own server. You might find that you would like
to switch over to the EFA server and make it an edge mail server to
be the most effective.</div>
<div>There are tons of other tricks to tune out a MailScanner
server if you have to time to implement them.</div>
<div>- postwhite</div>
<div>- SQLgrey or postgrey</div>
<div>- pypolicyd-spf to add an SPF check header used by
SA</div>
<div>- postscreen with many RBLs weighted to your needs</div>
<div>- <a href="http://senderscore.org" target="_blank">senderscore.org</a> RBL is very helpful (search SA mailing
list archives)</div>
<div>- Postfix tuning (reject_non_fqdn_sender,
reject_non_fqdn_recipient, reject_non_fqdn_hostname,
reject_unknown_sender_domain, reject_non_fqdn_helo_hostname</div>
<div>- Postfix rate limiting</div>
<div>- Postfwd to add custom headers, ex. etect large BCC and add a
custom header that can be used by SA for scoring</div>
<div>- opendkim to sign outbound messages for improved
delivery</div>
<div>- SA shortcircuit'ing to whitelist trusted senders</div>
<div>- SA whitelist_auth list so you can bump up BAYES_*
scores</div>
<div>- SA BAYES_* score adjustment</div>
<div>- SA bayes_ignore_header listing (search SA mailing list
archives)</div>
<div>- SA score tuning for reliable whitelists</div>
<div>- SA ham shortcircuit for very reliable whitelists</div>
<div>- ClamAV add extra signatures for more aggressive blocking
(search clamav-unofficial-sigs.conf)</div>
<div>- SA - custome rules download of <a href="http://20_axb_misc.cf">20_axb_misc.cf</a></div>
<div>- SA - enable RelayCountry and add custom rules for bad
countries for your users/region</div>
<div>- SA - ok_languages and ok_locales</div>
<div>....</div>
<div>Dave</div>
</div>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Thu, Jan 5, 2017 at 12:35 AM, Thom van
der Boon <span dir="ltr"><<a href="mailto:thom@vdb.nl" target="_blank">thom@vdb.nl</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div>
<div style="font-family:Helvetica;font-size:12pt;color:#000000">
<div>Hi<br></div>
<div><br></div>
<div>I use 2 things:<br></div>
<div><br></div>
<ul>
<li>Lower threshold: Spamassassin score:<br>
<ul>
<li>5: Mark as (possible) spam<br></li>
<li>10 (in stead of 15): delete<br></li>
</ul>
</li>
<li>use KAM.cf: KAM.cf is a very nice set of spammassassin rules
file which catches a awfull lot of spam<br></li>
</ul>
<div>You can find the <a href="http://KAM.cf.sh" target="_blank">KAM.cf.sh</a> script via Google<br></div>
<div><br></div>
<div>
<div>Met vriendelijke groet, Best regards,</div>
<div><br></div>
<div><br style="font-family:helvetica">
<span style="font-family:helvetica">Thom van der
Boon</span><br style="font-family:helvetica">
<span style="font-family:helvetica">E-Mail: <a href="mailto:thom@vdb.nl" target="_blank">thom@vdb.nl</a></span></div>
<div><br></div>
<div><br style="font-family:helvetica">
<br style="font-family:helvetica">
<span style="font-family:helvetica">=====</span></div>
<div><br></div>
<div><br></div>
<div><br></div>
<div><span style="font-family:helvetica">Thom.H. van der Boon
b.v.</span><br style="font-family:helvetica">
<span style="font-family:helvetica">Transito 4</span></div>
<div><span style="font-family:helvetica">6909 DA
Babberich<br style="font-family:helvetica"></span><span style="font-family:helvetica">Tel.: <a href="tel:+31%2088%20427%202727" value="+31884272727" target="_blank">+31 (0)88
4272727</a></span><br style="font-family:helvetica">
<span style="font-family:helvetica">Fax: <a href="tel:+31%2088%20427%202789" value="+31884272789" target="_blank">+31 (0)88 4272789</a></span><br style="font-family:helvetica">
<span style="font-family:helvetica">Home Page: <a href="http://www.vdb.nl/" target="_blank">http://www.vdb.nl/</a></span></div>
</div>
<div><br></div>
<hr id="m_9012973362565195742zwchr">
<div><b>Van:</b> "Danita Zanre" <<a href="mailto:danita@caledonia.net" target="_blank">danita@caledonia.net</a>><br>
<b>Aan:</b> <a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.<wbr>info</a><br>
<b>Verzonden:</b> Woensdag 4 januari 2017 17:50:42<br>
<b>Onderwerp:</b> Optimizing Anti-Spam<br></div>
<div><br></div>
<div>
<div>
<div class="h5">
<div id="m_9012973362565195742bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">
Hi all! It’s been years since I’ve implemented something like
Mailscanner as part of an anti-spam system, but I’ve used various
Linux based systems like Maia Mailguard in the distant past.
I've used appliances for quite awhile, but for various reasons have
now chosen Mailscanner for the task. Right now I’m training
and tweaking things on a smaller subset domain rather than flipping
the switch for my entire system. I’ve only been running for
about 5 days or so. I’m training the bayes database multiple
times a day with both spam and ham, and Spamassassin is now active,
but I have a lot of what I consider “obvious” spam leaking through
- vulgar words in the subject, sexual content, etc. While my
users will forgive marketing and general “junk”, they will be less
forgiving of these things ;-)</div>
<div id="m_9012973362565195742bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">
<br></div>
<div id="m_9012973362565195742bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">
I’m doing some research on the best settings to optimize. I
used to use things like Razor, DCC, selective greylisting, custom
rule sets. I imagine that these things have changed a lot in
the past 10 years. Can you give me some ideas on some
optimizations you use to tighten things up? </div>
<div id="m_9012973362565195742bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">
<br></div>
<div id="m_9012973362565195742bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px;margin:0px;line-height:auto">
Thanks!</div>
<div class="m_9012973362565195742bloop_container">
<div class="m_9012973362565195742bloop_frame"><br></div>
</div>
<br>
<div id="m_9012973362565195742bloop_sign_1483548055579247104" class="m_9012973362565195742bloop_sign"><b>Danita Zanrè</b>,
<i>Move Out of the Office</i>
<div>I love my job, and you can too!</div>
<div>Tel: <a href="tel:(720)%20319-7530" value="+17203197530" target="_blank">(720) 319-7530</a> - Caledonia Network
Consulting</div>
<div>Tel: <a href="tel:(720)%20319-8240" value="+17203198240" target="_blank">(720) 319-8240</a> - Move Out of the Office</div>
<div><br></div>
</div>
<br></div>
</div>
<span class="">--<br>
This message has been scanned for viruses and<br></span>
dangerous content by <a href="http://www.mailscanner.info/" target="_blank"><b>MailScanner</b></a>, and is<br>
<span class="">believed to be clean.<br>
<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info" target="_blank">mailscanner@lists.mailscanner.<wbr>info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" target="_blank">http://lists.mailscanner.info/<wbr>mailman/listinfo/mailscanner</a><br>
</span></div>
</div>
</div>
<br>
<br>
<br>
--<br>
MailScanner mailing list<br>
<a href="mailto:mailscanner@lists.mailscanner.info">mailscanner@lists.mailscanner.<wbr>info</a><br>
<a href="http://lists.mailscanner.info/mailman/listinfo/mailscanner" rel="noreferrer" target="_blank">http://lists.mailscanner.info/<wbr>mailman/listinfo/mailscanner</a><br>
<br>
<br></blockquote>
</div>
<br></div>
<br>
--<br>
This message has been scanned for viruses and<br>
dangerous content by <a href="http://iris.caledonia.net/"><b>Iris
MailScanner</b></a>, and is<br>
believed to be clean.
<br>
<br>--
<br>MailScanner mailing list
<br>mailscanner@lists.mailscanner.info
<br>http://lists.mailscanner.info/mailman/listinfo/mailscanner
<br>
<br></div></div></span></blockquote></body></html>