Re: question about filtering spam

[Reindl Harald]

Am 19.07.2016 um 23:41 schrieb Jan-Kees van Kampen:

FWIW all three of those messages came from sources that are on multiple
IP-based block-lists (DNSBLs) such as spamhaus.net, spamcop.net, &
abuseat.org.

If you were using those methods for filtering (either via postfix
filtering or
SA scoring) those messages shouldn't have made it thru your filtering
system.

thanks David,

I'll investigate, mail from grey-listed domains should not come through
indeed, (I didn't check), gonna do a bit of homework, obviously I'm
a bit green, thankfull for your responses though :)

greylisting don't matter here

179.49.71.250:
b.barracudacentral.org  LISTED  127.0.0.2
dnsbl.inps.de   LISTED  127.0.0.2
xbl.spamhaus.org        LISTED  127.0.0.4
bl.mailspike.net        LISTED  127.0.0.10 127.0.0.2
bl.spamcop.net  LISTED  127.0.0.2
bl.spameatingmonkey.net         LISTED  127.0.0.2
ix.dnsbl.manitu.net     LISTED  127.0.0.2
dnsbl-1.uceprotect.net  LISTED  127.0.0.2
psbl.surriel.com        LISTED  127.0.0.2
web.dnsbl.sorbs.net     LISTED  127.0.0.7
spam.dnsbl.sorbs.net    LISTED  127.0.0.6
junkemailfilter.com     LISTED  127.0.0.2 127.0.1.1
senderscore.com         LISTED  127.0.4.0



postscreen_dnsbl_threshold = 8
postscreen_dnsbl_action = enforce
postscreen_greet_action = enforce
postscreen_greet_wait = ${stress?3}${stress:10}s
postscreen_dnsbl_sites =
 dnsbl.sorbs.net=127.0.0.10*9
 dnsbl.sorbs.net=127.0.0.14*9
 zen.spamhaus.org=127.0.0.[10;11]*8
 dnsbl.sorbs.net=127.0.0.5*7
 zen.spamhaus.org=127.0.0.[4..7]*7
 b.barracudacentral.org=127.0.0.2*7
 zen.spamhaus.org=127.0.0.3*7
 dnsbl.inps.de=127.0.0.2*7
 hostkarma.junkemailfilter.com=127.0.0.2*4
 dnsbl.sorbs.net=127.0.0.7*4
 bl.spamcop.net=127.0.0.2*4
 bl.spameatingmonkey.net=127.0.0.[2;3]*4
 dnsrbl.swinog.ch=127.0.0.3*4
 ix.dnsbl.manitu.net=127.0.0.2*4
 psbl.surriel.com=127.0.0.2*4
 bl.mailspike.net=127.0.0.[10;11;12]*4
 bl.mailspike.net=127.0.0.2*4
 zen.spamhaus.org=127.0.0.2*3
 score.senderscore.com=127.0.4.[0..20]*3
 bl.spamcannibal.org=127.0.0.2*3
 dnsbl.sorbs.net=127.0.0.6*3
 dnsbl.sorbs.net=127.0.0.8*2
 hostkarma.junkemailfilter.com=127.0.0.4*2
 dnsbl.sorbs.net=127.0.0.9*2
 dnsbl-1.uceprotect.net=127.0.0.2*2
 all.spamrats.com=127.0.0.38*2
 bl.nszones.com=127.0.0.[2;3]*1
 dnsbl-2.uceprotect.net=127.0.0.2*1
 dnsbl.sorbs.net=127.0.0.2*1
 dnsbl.sorbs.net=127.0.0.4*1
 score.senderscore.com=127.0.4.[0..69]*1
 dnsbl.sorbs.net=127.0.0.3*1
 hostkarma.junkemailfilter.com=127.0.1.2*1
 dnsbl.sorbs.net=127.0.0.15*1
 ips.backscatterer.org=127.0.0.2*1
 bl.nszones.com=127.0.0.5*-1
 score.senderscore.com=127.0.4.[90..100]*-1
 wl.mailspike.net=127.0.0.[18;19;20]*-2
 hostkarma.junkemailfilter.com=127.0.0.1*-2
 ips.whitelisted.org=127.0.0.2*-2
 list.dnswl.org=127.0.[0..255].0*-2
 dnswl.inps.de=127.0.[0;1].[2..10]*-2
 list.dnswl.org=127.0.[0..255].1*-3
 list.dnswl.org=127.0.[0..255].2*-4
 list.dnswl.org=127.0.[0..255].3*-5

there is no reason that this message ever is touching SA at all with that blacklist hit of the source IP

signature.asc
Description: OpenPGP digital signature