Configure Exim RBL support and reduce SPAM

**ollopa** · 10-09-2002, 05:00 PM

http://www.exim.org/howto/rbl.html

I'm on whale and my domain recieves spam from systems that are on just about every black-listing service out there. I must therefore conclude that aletia is either not using these services or that they are not properly configured.

My suggestion is to configure the RBL support in exim to filter out a huge list of confirmed spammers. Did I mention that this service is FREE?

Please do this, it would be very helpful. You can even exempt specific accounts if they complain about the feature for some bizarre reason.

-Rick

**Neva** · 10-09-2002, 06:22 PM

You could always just turn on SpamAssassin? I have very little spam get through unmarked... and what does, I can usually get rid of with some custom configuration.

**ollopa** · 10-10-2002, 11:22 AM

No good. We used spamassassin but it does an entirely different thing.

Nobody wants to sift through 30 marked messages a day and SpamAssassin marks at least 10% of our valid messages as spam so we cannot rely upon it.

A good number of spam that we receive comes from HOSTS (not accounts, but entire systems) that have been set-up by spammers for that exclusive purpose. These hosts' IP addresses are well known and on black-lists. It only takes 5 minutes to configure exim to block these messages. I really want this feature, as does everyone else in the office.

**mdavis** · 10-10-2002, 10:52 PM

We also have SpamAssassin enabled. It does an okay job of catching most spam, but some okay stuff is mixed in, too. I'd like to have more info about integrating some sort of spammers list as a filter (if I am indeed understanding you correctly). I wonder how much of a hit he servers would take, though, culling through all the e-mail. Would it lead to DOS attacks?

**jkeller** · 10-11-2002, 10:31 AM

Anti-spam measures like what ollopa is talking about don't typically take an inordinate amount of overhead. As it is, all of our mail is already processed into files and directories (sinetad of using the normal spooling directory on /var), which actually takes more resources. So, using a blacklist isn't that bad.

The thing is that it would need to be configured as an option. I personally have a big problem with the "virus" filter (a joke of a name) that is included by default by CPanel and bounces all messages with certain attachment types. Every time CPanel updates a component (I don't know which), this switch gets turned back on. And then I ask to have it turned off by an admin (still waiting, too).

Anyhoo, I'm not a fan of the CPanel "Way". They give user configuration to some things, sure, but anything else is a custom config that gets crushed by the next CPanel update. As a result, an exim mod like the blacklist would eventually be overwirtten if hand-enabled, and out of users' hands even if it sticks.

I guess what I'm saying is; I'm for filtering software, as long as I have some control over it (minimally, "on" or "off"). I love SA, but I agree that it still means double-checking mail. I currently receive three or four messages a day from the same host, always the same domain. If I had a true bounce 'not jsut tag) ability, I could make it appear to them that I don't exist -- and I would never get the message. But I still want a bit of control over whether that's enabled for my account or not.

**jkeller** · 10-11-2002, 10:32 AM

By the way, ollopa: if you'd like I'd be happy to give you some pointers on SpamAssassin configuration options that have helped me avoid false positives. I haven't had a false positive in ages, and I get a broad range of message types.

**ollopa** · 10-11-2002, 10:55 AM

Thanks, but in the end even if SA never gave a false alarm the real goal is to prevent the message from ever even reaching the user. We have local junk-mail filters enabled which tag most of the messages in our clients anyway. People were asking me what was the point of SA if they still had to download and look at the messages.

That's the nice thing about RBL. You don't ever get the message and it's not a false alarm.

**jkeller** · 10-11-2002, 11:00 AM

Definitely; I just thought I'd offer help while waiting for Godot.

Lost in my rambling was my very deep desire to get "real" black-hole filters installed. I just want to have the ability to turn it on and off without submitting a support ticket every time I want to do that.

**megmond** · 10-11-2002, 01:25 PM

Originally posted by jkeller
...sinetad...

<ignore>How fast were you trying to type 'instead' here? Seems like you pressed all keys simultaneously...

(sorry, couldn't resist this one)</ignore>

**jkeller** · 10-11-2002, 03:01 PM

Originally posted by megmond
Seems like you pressed all keys simultaneously...

Not ahrd to od on a reFnch kyeabrod!

Ron · 10-19-2002, 10:10 PM

Just a quick note about false positives....

My old Aletia IP address was flagged as a "known spam IP" and my own cable-based ISP was using such an automatic filtering service... (I think the IP was listed in OSIRIS or some such)

My emails (to myself!) were being silently dropped on the floor. Of course, who knows how many people sent emails through my forum and those were dropped on the floor... how many notifications were never received...

Maybe 2 or 3. Well, it wasn't a very active site back then. Point is, false positives are a reality for any software that rejects emails. Wanna miss something from a customer?

Maybe set up a rule in your Outlook (or whatever) and automagically delete the 2 or 3 emails you get from the same domain every day?

SPAM sux.

**smartcomputers** · 10-21-2002, 05:21 AM

I spent a whole month trying to figure out how to reduce the incoming spam. I tried everything from spamassassin to custom filtering. The best solution I found was MailWasher (http://www.mailwasher.net). What this really simple proggie does is download the headers of the incoming mail, searches the spam archives for known spammers and flags the offending messages. It also has custom filters, blacklists, friendlists, and all sorts of configuration options. After the correct flagging, you just press a button and all offending messages bounce back. My spam has been reduced to 25% and I am only using it for a month. You should all try it.

Paul

**G.Bloke** · 10-21-2002, 06:03 AM

Mail Washer requires you to go through your incoming mail by hand ... well more or less and thats not the best solution. I'm suprised we've not heard anything yet from a Jaguar Representative but what I'd like to see is RBL support but with a Control Panel Option to turn it on or off. Similar to how SpamAssassin is currently setup.

I stopped using SpamAssassin as for the second time it failed and started to bounce all my incoming mail which was unacceptable.

The benefit of RBL is that mail is bounced with an explaination so that even if mail was genuine the sender will know why it didn't reach its target. Secondly if a spammer is using a genuine return address their inbox is swapped and they also know which addressess are protected.

**hobbes747** · 10-23-2002, 04:02 PM

I have the opposite problem. Every time I sign up for something like the Screensavers news letters, the initial shows up, I respond and get the next issue and then I get nothing.

**jkeller** · 10-24-2002, 10:23 AM

Originally posted by G.Bloke
[...] what I'd like to see is RBL support but with a Control Panel Option to turn it on or off. Similar to how SpamAssassin is currently setup.

Exactly my hope. Maybe it'll be something to suggest for their CPanel replacement, when the time comes.

LinkBack

Thread Tools

Display

Configure Exim RBL support and reduce SPAM

Bookmarks

Bookmarks

Posting Permissions