SPAM filter not working as good anymore

[sseverin]

A couple weeks ago, one of our customers noticed that they were having a lot more SPAM coming through the Untangle. Normally they would get 5 or so a week that would sneak through, but last weekend, one of the users had 38 that ended up in her junk mail box and 7 more in her inbox.

I have the SPAM filter on the second most aggressive setting and that the emails that do make it through have a low enough SPAM score that they would have made it through anyway.

Any reason why this would start happening? More than one customer is having this issue and all are using their own Exchange Server.

[hlarsen]

what does the Event Log show? is it scoring the spam properly?

[sseverin]

From what I had seen, the SPAM scores were under 3.0. Including one customer right now that has quite a lot of messages that show a SPAM score of -0.1 from places like noreply @ datafunds.info or noreply @ refleepstia.net talking about payday loans and such, which I know this particular customer has no interest in.

So a lot of them just look like they're getting scored wrong.

[hlarsen]

you can use the 'Add email headers' option in Spam Blocker to see why they are getting scored like that - just turn the option on and view the headers of an email that makes it to the inbox.

[sseverin]

Sorry for taking a long time to respond, but the SPAM is still coming through, here are some of the header info that Untangle put in:

X-spam-status: No, score=2.5 required=3.3
tests=SPF_PASS,HTML_MESSAGE,RAZOR2_CF_RANGE_E8_51_ 100,RAZOR2_CHECK,RAZOR
2_CF_RANGE_51_100

X-Spam-Flag: NO

and

X-spam-status: No, score=2.5 required=3.3
tests=SPF_PASS,MIME_HTML_MOSTLY,HTML_MESSAGE,RAZOR 2_CF_RANGE_E8_51_100,R
AZOR2_CHECK,RAZOR2_CF_RANGE_51_100

X-Spam-Flag: NO


Is there anything obvious on why these are getting through? Is my Untangle not doing all the checks it should?

[dmorris]

How is your DNS configured on the Untangle server?

[sseverin]

DNS on External Interface is setup to use OpenDNS. Internal DNS taken care of by Windows Server.

[dmorris]

You need to use your ISP's DNS.
OpenDNS can cause issues with DNSBLs (RBLs)

[doubtintom]

dmorris

What about Google's DNS 8.8.8.8 and 8.8.4.4? Same issue?

Thanks

[dmorris]

dmorris

What about Google's DNS 8.8.8.8 and 8.8.4.4? Same issue?

Thanks

Yes, those don't work at all.