Spamhaus Help

[BenV]

I am having a huge spam problem and need a couple more heads if you can lend yours...

I have a server running qmail and some of Bruce's stuff setup similar to FQ. One particular domain on this server has a catchall that pipes (via dot-qmail) to a perl script that determines delivery (or not). This has been working great for years and I get 1-2 spams a day that make it to my inbox.

Here's the problem -- this domain used to get over 10,000 spam a month when I monitored it more closely last year. No real biggie. But I noticed some intermittent sluggishness on the server recently and tracked it down to my script consuming resources. As it turns out, that domain has been getting over 20,000 PER DAY on average over the last few months. In the 5 days following Easter it received 181,000 emails per day.

Now that's just crazy!

So I decided to implement the spamhaus RBL in the hopes of buffering the server a bit. Here's the pertinent line in my run file:

exec /usr/local/bin/softlimit -m 5000000 \
/usr/local/bin/tcpserver -v -R -l 0 -x /etc/tcp.smtp.cdb -c "$MAXSMTPD" \
-u "$QMAILDUID" -g "$NOFILESGID" 0 smtp rblsmtpd -r sbl-xbl.spamhaus.org \
/usr/bin/smtpfront-qmail 2>&1

It still seems to be letting in about 50% of the spam -- up from about 90% in the first few days. It's my understanding that (in it's default configuration) if rblsmtpd times out waiting for spamhaus, it lets the email through which makes sense to me.

In any case, does anyone have any insight into how I can increase the amount it blocks? -- in the last 6 days, my perl script still blocked about 60,000 emails per day.

BenV

[kitchin]

Is there a way to cache that RBL stuff locally?

[sheila]

FutureQuest's exeperience, is that you need to use multiple RBLs in order to block the overwhelming amount of spam.

If you don't mind blocking based on geography (since this appears to be your own personal server?) you might want to try blocking IPs in China, South America, and other locations... There are RBLs that specialize in listing these types of IP addresses...

With SpamHaus you are probably only going to block about 50%.

Although SpamCop can be aggressive and occassionally blocks valid email, FutureQuest has found that it is the most effective RBL currently in preventing spam from entering our network.

[BenV]

Is there a way to cache that RBL stuff locally?
My understanding is that caching the RBL results is a big NO NO since the the list is by definition dynamic. Even short term caching can have negative consequences for blocking legitimate mail.

That said, that was my first question too. :)

---
BenV

[BenV]

Sheila:

Thanks. I am purposely proceeding very conservatively but I have implemented the SpamCop RBL too and will see how it goes.

From there I'll move on to geography blocking if I feel like I need to. But seeing how this isn't really impacting people (dictionary spam) I just need to make sure the server performance isn't negatively impacted.

I'll let you know...

BenV

[sheila]

Ben, If it is dictionary spam, why don't you turn off accepting email to addresses that are not defined on the system?

I'm running Postfix on my iMac and only accept email to legitimate, defined addresses on my system, and get nearly zero spam. This is for a domain that has been around for a few years (more than 3) and when I used the Mercury mail server on my Win2K machine, used to pick up a fair amount of spam.

Postfix is installed on Mac OS X by default (although not enabled) and so I just went with that, rather than investigating qmail or some other possible server solution.

I suppose you may need to run RBLs even with turning off email to non-existent addresses, depending on your situation. But it would be less work for your system to simply reject email sent to invalid addresses?

[BenV]

Ben, If it is dictionary spam, why don't you turn off accepting email to addresses that are not defined on the system?On this domain, I use the catchall because my perl script uses regex matching to block/accept email. For example I block email on a list I am on that mentions a certain person; I accept email from anyone sent to certain address prefixes; I accept email sent to today's date (yyyymmdd@), etc...

I suppose if Bruce :bow: implemented (cough) qmail style alias prefix- matching in vmailmgr, then I'd probably do away with my script. :yeah:

I'm running Postfix on my iMac and only accept email to legitimate, defined addresses on my system, and get nearly zero spam.Postfix is cool in that it rejects invalid emails at the SMTP conversation rather than processing the email and generating a bounce. I can see the merits of both methods but the Postfix way has certain advantages for all but the most busy servers.

BenV