SPAM Getting Through

[AdamB]

I'm not sure who "207.14.235.234" is, but its pretty much completely borked.

It know I'm a broken record, but its not really worth investigating spam stuff until you get your DNS situation completely sorted. Untangle needs a completely functional and reliable internet connection.



even just simple tests by hand show bizarre results:

Every time I would run the test manually it would come back clean and we stopped getting alerts in the Untangle GUI, so I figured everything was good. I just ran it this morning and I am seeing the same results as you. Does anyone have any suggestions on good DNS servers? Our ISP's are Verizon, Century Link, Level3 and Time Warner. All of which provide bad results for this when using their supplied DNS servers. If the public DNS servers don't work, and the DNS server from all of the ISP's listed above don't work, what should I use?

Also leads me to wonder why the support person working with us doesn't look at this right off the bat instead of telling us "thats how it is".

[AdamB]

Well found another DNS server that is working well for now. I guess I will need to keep a much closer eye on this.

[root @ untangle] ~spamd/.spamassassin # curl -s http://www.untangle.com/download/patches/generic/check_spam_health.sh | bash

Testing dnsmasq ...
[127.0.0.1] : DNS       passed
[127.0.0.1] : SORBS       passed
[127.0.0.1] : SpamCop       passed
[127.0.0.1] : SpamHaus       passed
[127.0.0.1] : SURBL       passed   
[127.0.0.1] : URIBL       passed   
[127.0.0.1] : URIBL       passed   
[127.0.0.1] : DNSWL       passed   
[127.0.0.1] : DNSWL       passed   
[127.0.0.1] : IADB       passed    

Testing 207.69.188.185 ...
[207.69.188.185] : DNS       passed
[207.69.188.185] : SORBS       passed
[207.69.188.185] : SpamCop       passed
[207.69.188.185] : SpamHaus       passed
[207.69.188.185] : SURBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : IADB       passed    

Testing 205.152.37.23 ...
[205.152.37.23] : DNS       passed
[205.152.37.23] : SORBS       passed
[205.152.37.23] : SpamCop       passed
[205.152.37.23] : SpamHaus       passed
[205.152.37.23] : SURBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : IADB       passed    

Testing 207.69.188.185 ...
[207.69.188.185] : DNS       passed
[207.69.188.185] : SORBS       passed
[207.69.188.185] : SpamCop       passed
[207.69.188.185] : SpamHaus       passed
[207.69.188.185] : SURBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : IADB       passed    

Testing 205.152.37.23 ...
[205.152.37.23] : DNS       passed
[205.152.37.23] : SORBS       passed
[205.152.37.23] : SpamCop       passed
[205.152.37.23] : SpamHaus       passed
[205.152.37.23] : SURBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : IADB       passed    

Testing 207.69.188.185 ...
[207.69.188.185] : DNS       passed
[207.69.188.185] : SORBS       passed
[207.69.188.185] : SpamCop       passed
[207.69.188.185] : SpamHaus       passed
[207.69.188.185] : SURBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : URIBL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : DNSWL       passed   
[207.69.188.185] : IADB       passed    

Testing 205.152.37.23 ...
[205.152.37.23] : DNS       passed
[205.152.37.23] : SORBS       passed
[205.152.37.23] : SpamCop       passed
[205.152.37.23] : SpamHaus       passed
[205.152.37.23] : SURBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : URIBL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : DNSWL       passed   
[205.152.37.23] : IADB       passed    

Testing 207.69.188.185 ...
[207.69.188.185] : DNS       passed
[207.69.188.185] : SORBS       passed
[207.69.188.185] : SpamCop       passed
[207.69.188.185] : SpamHaus       passed
[207.69.188.185] : SURBL       passed
[207.69.188.185] : URIBL       passed
[207.69.188.185] : URIBL       passed
[207.69.188.185] : DNSWL       passed
[207.69.188.185] : DNSWL       passed
[207.69.188.185] : IADB       passed

Testing 205.152.37.23 ...
[205.152.37.23] : DNS       passed
[205.152.37.23] : SORBS       passed
[205.152.37.23] : SpamCop       passed
[205.152.37.23] : SpamHaus       passed
[205.152.37.23] : SURBL       passed
[205.152.37.23] : URIBL       passed
[205.152.37.23] : URIBL       passed
[205.152.37.23] : DNSWL       passed
[205.152.37.23] : DNSWL       passed
[205.152.37.23] : IADB       passed

Testing 207.69.188.185 ...
[207.69.188.185] : DNS       passed
[207.69.188.185] : SORBS       passed
[207.69.188.185] : SpamCop       passed
[207.69.188.185] : SpamHaus       passed
[207.69.188.185] : SURBL       passed
[207.69.188.185] : URIBL       passed
[207.69.188.185] : URIBL       passed
[207.69.188.185] : DNSWL       passed
[207.69.188.185] : DNSWL       passed
[207.69.188.185] : IADB       passed

Testing 205.152.37.23 ...
[205.152.37.23] : DNS       passed
[205.152.37.23] : SORBS       passed
[205.152.37.23] : SpamCop       passed
[205.152.37.23] : SpamHaus       passed
[205.152.37.23] : SURBL       passed
[205.152.37.23] : URIBL       passed
[205.152.37.23] : URIBL       passed
[205.152.37.23] : DNSWL       passed
[205.152.37.23] : DNSWL       passed
[205.152.37.23] : IADB       passed

Analyzing mail.log ...
Results:  passed (70420 results)
RAZOR:    passed (39779 results)
BAYES:    passed (66064 results)
AWL:      passed (0 hits)

I also reset the bayes database as from what you guys are saying tarpitting should have effected the bayes learning and its been on since I re installed.

[sky-knight]

If you want to do spam filtration, and you want your DNS to work forever and more you need to be running your own DNS resolvers. Any use of any public resolver will eventually give you grief.

[AdamB]

If you want to do spam filtration, and you want your DNS to work forever and more you need to be running your own DNS resolvers. Any use of any public resolver will eventually give you grief.

Appreciate the input. I will start looking into whats needed to get that done.

[fasttech]

If you want to do spam filtration, and you want your DNS to work forever and more you need to be running your own DNS resolvers. Any use of any public resolver will eventually give you grief.

What do you think the odds are your own resolver will likely get blocked?
Perhaps the volume, or lack thereof, from it would be negligible and un-noticed.

My 2c, I've been using Thunderbird installs to dump spam because it's so far been 700+% more effective than Untangle's free filter on v9, no matter the dns used.

[sky-knight]

Your own resolver would have to be used by an Untangle filtering over 100,000 emails a day before it was an issue. If you've got that level of mail volume, you're not using untangle to filter mail.

That being said, it's rather easy for say a Cox DNS server to be responsible for that many spam checks in a given day.

[Teemoo]

You're definitely not alone with this problem as of late. Haven't touch my Untangle in months as far as settings go, and the last few weeks have been getting swamped with spam, as if I have no line of defense at all. I made sure my DNS is working OK and then disabled Tarpitting per this post and a couple others...we will see if it helps at all.

And lol@"thats just how it is"...quite a response to a support ticket. I may use that for my next customer ticket response.

[AdamB]

You're definitely not alone with this problem as of late. Haven't touch my Untangle in months as far as settings go, and the last few weeks have been getting swamped with spam, as if I have no line of defense at all. I made sure my DNS is working OK and then disabled Tarpitting per this post and a couple others...we will see if it helps at all.

And lol@"thats just how it is"...quite a response to a support ticket. I may use that for my next customer ticket response.

Yea I want to say its getting a bit better with our new setup, but I need to give it more time.

I agree, if I told one of our customers that, I would be looking for a new job.

[Danp]

I installed v11 over the weekend, and I've allowed a few days for it to get "trained" properly and the bayes filtering to kick in. Biggest issue I'm seeing currently is the following:

	
drop excess lbs - (10days)	pass message	2.3	BAYES_99[3.5] SPF_HELO_PASS[-0.0] SPF_PASS[-0.0] RP_MATCHES_RCVD[-1.4] BAYES_999[0.2]

The bayes filtering is working, but the RP_MATCHES_RCVD rule is dropping the score below 3.5.
Thankfully this isn't occurring too often, and overall the flow of spam seems to be reduced.

[dmorris]

http://spamassassin.1065346.n5.nabbl...-td111557.html
http://www.gossamer-threads.com/list...n/users/166185

Yeah, other people tend to agree with you.

I hate to hack spamassassin updates, but I might change that value.