Getting hammered by backscatter

2008-10-30 Thread Chris Arnold
We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra, http://www.postfix.org/BACKSCATTER_README.html#real but still

Problems with the email adress of our company

2008-10-30 Thread Marie Gabriele Licht
Hi there, we have some problems with the email-address of our company. When we write emails to people with a [EMAIL PROTECTED] address, the receiver won't get the email because it's in the spam folder. Gmx's support told us that they use spam assassin. Can you help us? Can you

Re: Problems with the email adress of our company

2008-10-30 Thread Matt Kettler
Greg Troxel wrote: we have some problems with the email-address of our company. When we write emails to people with a [EMAIL PROTECTED] address, the receiver won't get the email because it's in the spam folder. Gmx's support told us that they use spam assassin. Can you help us?

Re: Spamassassin+amavis

2008-10-30 Thread SM
At 05:51 30-10-2008, Luis Hernán Otegui wrote: Just to check, you know you should run a RBL check in Postfix BEFORE it accepts te message, do you? This reduces dramatically the number of messages your server has to scan. And improves the performance a lot. You should not run RBL checks on

Re: Problems with the email adress of our company

2008-10-30 Thread Joseph Brennan
Greg Troxel [EMAIL PROTECTED] wrote: But even with gmx addressed separately, 4.2 points is a very high score, and there is a large installed base. So I would advise considering registering rss-gmbh.de and using that instead, but doing your own testing first. Asking someone to change their

Re: Problems with the email adress of our company

2008-10-30 Thread Greg Troxel
Asking someone to change their domain name to match an SA rule seems a bit extreme to me! Why not propose that de establish a gmbh 2nd level for companies, and make him rss.gmbh.de? FROM_DOMAIN_NOVOWEL was logged for only 3 messages here yesterday, of 1.3 million logged as scoring 7.0

Re: Getting hammered by backscatter

2008-10-30 Thread Karl Pearson
On Wed, 29 Oct 2008, Chris Arnold wrote: We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix backscatter rules in postfix of zimbra,

Re: Getting hammered by backscatter

2008-10-30 Thread Martin Gregorie
On Thu, 2008-10-30 at 10:28 -0600, Karl Pearson wrote: On Wed, 29 Oct 2008, Chris Arnold wrote: We use zimbra OSS on SLES10 SP1. Zimbra has spamassassin built-in. At the present time, my mailbox is filled with backscatter; getting around 10 a minute since 4:30 today. I have postfix

Phishing rules?

2008-10-30 Thread Micah Anderson
I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client list.dsbl.org, I've got

Re: Phishing rules?

2008-10-30 Thread Randy
Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client

Re: Phishing rules?

2008-10-30 Thread Bill Landry
Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org, reject_rbl_client

Re: Phishing rules?

2008-10-30 Thread Karsten Bräckelmann
On Thu, 2008-10-30 at 15:56 -0400, Micah Anderson wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: postfix is doing: reject_rbl_client b.barracudacentral.org, reject_rbl_client zen.spamhaus.org,

Re: Phishing rules?

2008-10-30 Thread Kelson
Micah Anderson wrote: reject_rbl_client list.dsbl.org, DSBL has shut down, and you should remove the query from your list. It won't help with the phishing, but it'll free up some network resources. Info: http://dsbl.org/node/3 I've got clamav pulling signatures updated

Re: Phishing rules?

2008-10-30 Thread Joseph Brennan
Micah Anderson [EMAIL PROTECTED] wrote: I keep getting hit by phishing attacks, and they aren't being stopped by anything I've thrown up in front of them: Do you mean attempts to get your users to send their passwords, or fake mail pretending to be from banks? Joseph Brennan Lead Email