Still lots of spam getting through

[iceruam]

I have the spam blocker lite set to 0.2 and I still am getting lots of spam. Is there a training mechanism on this?

[dmorris]

No spam blocker [lite] auto-trains itself

[sky-knight]

https://wiki.untangle.com/index.php/...k_DNSBL_Access

Seriously... do it... if you get any fails, you've got work to do on your DNS. Long story short, Spam Blocker isn't very useful if you don't have your own DNS servers to fuel those lists.

[iceruam]

this is the results:

Testing dnsmasq ...
[127.0.0.1] : DNS passed
[127.0.0.1] : SORBS passed
[127.0.0.1] : SpamCop passed
[127.0.0.1] : SpamHaus passed
[127.0.0.1] : SURBL passed
[127.0.0.1] : URIBL passed
[127.0.0.1] : URIBL passed
[127.0.0.1] : DNSWL passed
[127.0.0.1] : DNSWL passed
[127.0.0.1] : IADB passed

Testing 23.235.16.2 ...
[23.235.16.2] : DNS passed
[23.235.16.2] : SORBS passed
[23.235.16.2] : SpamCop passed
[23.235.16.2] : SpamHaus passed
[23.235.16.2] : SURBL passed
[23.235.16.2] : URIBL passed
[23.235.16.2] : URIBL passed
[23.235.16.2] : DNSWL passed
[23.235.16.2] : DNSWL passed
[23.235.16.2] : IADB passed

Testing 10.1.1.10 ...
[10.1.1.10] : DNS passed
[10.1.1.10] : SORBS passed
[10.1.1.10] : SpamCop passed
[10.1.1.10] : SpamHaus passed
[10.1.1.10] : SURBL passed
[10.1.1.10] : URIBL passed
[10.1.1.10] : URIBL passed
[10.1.1.10] : DNSWL passed
[10.1.1.10] : DNSWL passed
[10.1.1.10] : IADB passed

Analyzing mail.log ...
Results: passed (2185 results)
RAZOR: passed (226 results)
BAYES: passed (2185 results)
AWL: passed (0 hits)

[sky-knight]

That's good, next... where is your mail server?

[iceruam]

ISP -> Router -> Untangle -> Mail

[sky-knight]

Untangle is a bridge or a router?

Long question chain short, I'm trying to verify that Untangle is actually inline to see the SMTP sessions as they impact on your server. Does Untangle block some spam?

[iceruam]

i have untangle setup bridged, it is behind the router. yes it blocks some spam but seems to be less than half. This is a sample of the messages getting through

Toenail Fungus? Try This 10-Minute Cure P -1.2 false SPF_PASS[-0.0] RP_MATCHES_RCVD[-0.0] MIME_HTML_ONLY[0.7] BAYES_00[-1.9] HTML_MESSAGE[0.0] T_DKIM_INVALID[0.0]
Cannabis Oil for Your Stress (Samples) �� P -0.2 false URIBL_BLACK[1.7] SPF_PASS[-0.0] BAYES_00[-1.9] T_DKIM_INVALID[0.0]
Restore Crystal Clear 20/20 Vision P -0.2 false URIBL_BLACK[1.7] SPF_PASS[-0.0] BAYES_00[-1.9] T_DKIM_INVALID[0.0]
betty_broadstreet-ryan=xmail.com@carry1anyone.science You have a message from someone at Elite Singles P -1.9 false SPF_PASS[-0.0] BAYES_00[-1.9] HTML_MESSAGE[0.0] HTML_IMAGE_ONLY_32[0.0] T_DKIM_INVALID[0.0]
annie.garg-pam=xmail.com@carry1anyone.science 14 Compatible Matches near you wanna chat P -1.9 false SPF_PASS[-0.0] BAYES_00[-1.9] HTML_MESSAGE[0.0] T_DKIM_INVALID[0.0]
hilary-ramero-john=xmail.com@carry1anyone.science Find a Truly Compatible Match with EliteSingles P -1.9 false SPF_PASS[-0.0] BAYES_00[-1.9] HTML_MESSAGE[0.0] HTML_IMAGE_ONLY_32[0.0] T_DKIM_INVALID[0.0]
[email]
bounce-757_html-12925245-104563-7290...cstatesman.com Sarah Sanders Demolishes Snotty Reporter P -1.5 false RCVD_IN_DNSWL_NONE[-0.0] SPF_PASS[-0.0] RP_MATCHES_RCVD[-0.0] BAYES_00[-1.9] HTML_IMAGE_RATIO_02[0.4] HTML_MESSAGE[0.0] T_DKIM_INVALID[0.0]
bo-b342wksbffsvbvaucp84bbymyh5tpq@b....ectionsetc.com Only hours left until Santa's sleigh leaves - HURRY! P -1.3 false RCVD_IN_DNSWL_NONE[-0.0] SPF_PASS[-0.0] RP_MATCHES_RCVD[-0.0] HTML_FONT_LOW_CONTRAST[0.0] BAYES_00[-1.9] HTML_IMAGE_RATIO_04[0.6] HTML_MESSAGE[0.0] LOTS_OF_MONEY[0.0] T_DKIM_INVALID[0.0]

[dmorris]

Thanks for posting details.

The issue looks like the Bayes has mistrained itself. It is certain these are not spam which is obviously to us not true.
That's why it is subtracting 1.9

Search for how to clear Bayes on forums.
I'm on my phone and will post a link later.

[dmorris]

To do so run these commands:

/bin/rm -f /home/spamd/.spamassassin/bayes*
service spamassassin restart