Anyone got any suggestions? I think what would really help would be if I
could figure out a relatively easy way to train my SA boxes. If there
was a simple and easy way for my customers to report spam and help train
the spam filters that would be great...the problem is not everyone uses
our webmail clients or even IMAP for that matter.
I was hoping to hear from some fellow toaster users out there that have
multiple domains with many users to see how they are accomplishing
things. If nothing else, if someone knew of a good way to create "spam"
or "junk" folders for the IMAP users and then automatically move
messages that were tagged by SA into the junk folders, that would be slick.
I know there is a plugin for roundcube, that I actually am using on a
Debian server at home but I'm wondering if there is a way to global
implement this. I'd rather have this take place outside of any webmail
interface, and instead incorporate it at a lower level with with the
IMAP/POP3 daemons. I wouldn't be surprised if this could easily be
accomplished using Dovecot, but I'm really not sure - and last I heard,
Qmailtoaster was still using Courier in the official releases. Doesn't
mean I'm not willing to veer from the norm and switch to the up and
coming ;-)
The real tricky part at the moment is that I have my server's roles all
split up, so mail hits spamdyke, then gets passed to the SA servers, and
then from there it goes to the server that actually houses the user
accounts and mail. I think that's what adds a layer of complexity to
using spamassassin and effectively training it.
Help! Please?
Casey
On 11/21/11 3:15 PM, Casey wrote:
Hi all,
Been getting some complaints recently from a couple of customers that
have been receiving a bit more spam than usual. Just wanted to see how
others had their spamdyke/simscan/spamassassin/clamav configured.
Spamdyke is definitely doing its job and doing it well on my gateway
servers, as you can see below:
*Gateway1
*This report was generated Mon Nov 21 00:11:55 2011
244499 70.34% DENIED_RDNS_MISSING
37848 10.88% DENIED_RDNS_RESOLVE
25915 7.45% DENIED_GRAYLISTED
24359 7.00% ALLOWED
9045 2.60% TIMEOUT
5106 1.46% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
698 0.20% DENIED_SENDER_NO_MX
41 0.01% DENIED_OTHER
28 0.00% ERROR
17 0.00% DENIED_SENDER_BLACKLISTED
11 0.00% DENIED_TOO_MANY_RECIPIENTS
---------------- Summary ----------------
Allowed: 24359 7.00%
Timeout: 9045 2.60%
Errors : 28 0.00%
Denied : 314135 90.38%
Total : 347567 100.00%
*Gateway2*
This report was generated Mon Nov 21 00:06:33 2011
235998 86.06% DENIED_RDNS_MISSING
23896 8.71% DENIED_RDNS_RESOLVE
8414 3.06% DENIED_GRAYLISTED
3570 1.30% TIMEOUT
1092 0.39% ALLOWED
692 0.25% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
484 0.17% DENIED_SENDER_NO_MX
57 0.02% DENIED_OTHER
14 0.00% ERROR
---------------- Summary ----------------
Allowed: 1092 0.39%
Timeout: 3570 1.30%
Errors : 14 0.00%
Denied : 269541 98.29%
Total : 274217 100.00%
*
Gateway3*
This report was generated Mon Nov 21 00:05:16 2011
11899 41.92% DENIED_RDNS_RESOLVE
10505 37.01% DENIED_RDNS_MISSING
3237 11.40% DENIED_GRAYLISTED
1970 6.94% TIMEOUT
334 1.17% DENIED_RBL_MATCH
-------------- Breakdown ---------------
-----------------------------------------
219 0.77% DENIED_SENDER_NO_MX
196 0.69% ALLOWED
23 0.08% DENIED_OTHER
1 0.00% DENIED_EARLYTALKER
---------------- Summary ----------------
Allowed: 196 0.69%
Timeout: 1970 6.94%
Errors : 0 0.00%
Denied : 26218 92.36%
Total : 28384 100.00%
Yet, I'm still receiving complaints from a few. I think my
spamassassin boxes need some tuning, but I'm not sure where to start.
How are others handling spamassassin training? I just noticed that
"use_bayes", "use_bayes_rules", and "bayes_auto_learn" were all
previously set to "0", so I enabled them all over the weekend..but I
have the feeling theres a bit more to it than that. For example, what
would be the best way to train SA on servers that are handling
hundreds of domains?
Our gateway servers don't actually have the users or mail stored on
them, they simply accept mail for the domains listed in rcpthosts, and
send them to the appropriate servers using smtproutes. So I'm not sure
how this factors in.
Any help would be appreciated.
Thanks,
Casey
