spam by the ocean liner load; cnc email manager clumsy

[colulus]

Before reading the rest of this, I just want to emphasize my punchline question: can I directly edit the files which the CNC email manager edits to manage aliases?

I recently reviewed email from FQuest warning me about possible spam abuses from my domain (it was an old email, sorry for reviewing it only now). It advised removing auto-bounce filters, etc.. I did as advised ... and now today I have over 3500 new "delivery failure" emails from various parties saying they think the post from omgthisisspam@mydomain.com is spam.

I am writing this up in the forum because I suspect others have experienced this. What the heck am I supposed to do?

I want to enable catch-all because I like having custom email addresses all forwarded to one pop mailbox, and I do not like using the CNC email manager to do so. The more aliases I set up with the CNC email manager, the longer it takes for Fquest to render that email management page. Even with very few addresses, it takes a long time to render the page. I can't stand using it. So right now I am left with using "catch-all".

What I'd like to do is create a filter for the catch-all, one which will bounce anything going to an address not in a simple list. I dont want to have to filter "to", "cc", "bcc (which doesnt exist)", etc. I just want all mails destined to a certain list of addresses to be caught by the catch-all, and everything else bounced the same way they'd be if catch-all wasnt enabled.
That is what the CNC email manager is designed to handle (you enter aliases), but it is too dang slow. Is there a way to directly edit the files which the CNC email manager edits?

Thanks

[colulus]

I've found post "Reduce forged address blowback for catchall email" http://www.aota.net/forums/showthread.php?t=23277 elsewhere in the forum and am reviewing that as a possible answer to my query ;).

[sheila]

To answer your punchline: No, it isn't possible for you to edit the files directly, in general. We are working on making some command line tools available, and they should be available for use in the near future. Specifically, the ability to add aliases via the commandline (http://www.aota.net/forums/showthread.php?postid=162713#post162713) is in the process of being implemented, and that would allow you to add aliases without loading the CNC's Email Manager.

I'm not entirely clear on what "I did as I was advised" means...

Also, to be clear, you can't have the catch-all enabled and have some email addresses handled as they would be if the catch-all were not enabled.

If the catch-all were not enabled, the invalid email addresses would not be bounced. For them to be bounced, they would have to be accepted first. Then, after accepting them, we would "bounce" them to the SENDER as advertised in the message envelope (not the same as the message header in all cases). In the case of spam the "SENDER" listed in the message envelope is usually not the true sender, and thus some innocent third party gets the bounce failure (such as you are experiencing now).

If, on the other hand, the catch-all were disabled, then the email sent to invalid addresses would not be accepted by our system at all. It would simply be refused. It would be refused to the original sending SMTP server. No bounce would be generated and the innocent third party would not receive the delivery failure notices.

What I'd like to do is create a filter for the catch-all, one which will bounce anything going to an address not in a simple list. I dont want to have to filter "to", "cc", "bcc (which doesnt exist)", etc. I just want all mails destined to a certain list of addresses to be caught by the catch-all, and everything else bounced the same way they'd be if catch-all wasnt enabled.
We would ask that you consider not bouncing such emails, as they are most likely spam. Instead, delete them or redirect them to a POP mailbox for later review (a local POP mailbox on the FutureQuest network).

Hrrm. I thought at first there was a simple way to implement what you wanted with a global built-in filter, but on typing up the "solution" I realized I was not thinking it through properly.

Will have to think on this one a bit more...

[colulus]

We would ask that you consider not bouncing such emails, as they are most likely spam. Instead, delete them or redirect them to a POP mailbox for later review (a local POP mailbox on the FutureQuest network).
That's what I did the other day, and then received several thousand junk mails (failure notices) in the destination POP box.

I've decided to completely disable spamassassin as it seems useless. Things which are obviously spam, I don't need it for, and plenty of things which are obviously spam are not flagged anyway. Disabling this obsolete filter should save some server load and mailbox space.

Ideally, I'd stop using catchall, which is why I want to manage aliases outside of CNC. In the meantime, I'd like a recommendation on how to handle all this spam. My spam-catching POP box received over 20 Megs of mail in one day.

To handle catch-all mail bounced to my domain, I'm going to try the suggestion in the thread which I linked to above, though I'm not sure how to use it yet:
Use the Built-in Filter "SMTP sender addresses" with
Filter Action: Redirect
If Redirect, email address to forward to:good@yourdomain.tld
List of Target Sender address patterns: @*

[Buck]

Looking at my off-line stats from another filter, it looks like Spam Assassin's killrate has improved dramatically in the past 5 or 6 months, from 75% to now better than 91%.

I wouldn't abandon it yet.

[sheila]

To handle catch-all mail bounced to my domain, I'm going to try the suggestion in the thread which I linked to above, though I'm not sure how to use it yet:

You would want to go into the CNC Email Manager and click on the name of the mailbox to which your Catch-all forwards.

Then on the next screen (Mailbox Properties) there is a link to edit the Built-In Filters. Click on that edit link.

Now scroll through the page of Built-In filters to find the SMTP Sender filter and click on that.

On that page, enter in the information:
Use the Built-in Filter "SMTP sender addresses" with
Filter Action: Redirect
If Redirect, email address to forward to:good@yourdomain.tld
List of Target Sender address patterns: @*


Note that "good@yourdomain.tld" should be the email address to which you want all of your good email redirected. Ideally, this would be a POP mailbox on your domain, but not the same one that your catch-all redirects to.

Hope that gets you started...

[Bruce]

We are working on making some command line tools available, and they should be available for use in the near future.These tools have now been installed (http://www.aota.net/forums/showthread.php?t=23486). Good luck! :yeah: