Spam Filter ISP Forums : Moving SF as second layer anti spam

Moving SF as second layer anti spam : Its not a matter of syncing as...

Wed, 01 Aug 2007 08:09:37 +0000

Author: WebGuyz
Subject: 6168
Posted: 01 August 2007 at 8:09am

Its not a matter of syncing as it is using the Merak API and re-creating the AuthorizedTo.txt list every 10 minutes (or 30 or more on a less busy system). Will send you the asp & vbs scripts in a PM in a day or so after I find them. With current SFE setup all our customers enter email inserts/deletes thru our Helm control panel and we have triggers set in the Helm SQL db for the control panel to automatically insert/delete entries in SFE database so we no longer have to re-create a text file list like we did with SFI every 10 minutes.

Moving SF as second layer anti spam : Yes. I agree with you. Roberto...

Wed, 01 Aug 2007 02:50:01 +0000

Author: tckoay
Subject: 6168
Posted: 01 August 2007 at 2:50am

Yes. I agree with you. Roberto team giving me very good support. I rate their support 10 out of 10.

I aware of AuthorizedTo features. Can you share with me how you can make it integrate with 3rd party mail server. Lets' take Merak for example, as the customer may add & remove user anytime. You script/API will able to "Sync" with merak users list? Can you share the secret of it?

Thank you.

Moving SF as second layer anti spam : I feel your pain about spending...

Wed, 01 Aug 2007 01:31:24 +0000

Author: WebGuyz
Subject: 6168
Posted: 01 August 2007 at 1:31am

I feel your pain about spending money trying out different AS methods. Been there, done that, and got the empty wallet to prove it.

You can use SF and the AuthorizedTo list to only accept valid users. We have a script that polls our control panel for any new email inserts/deletes and updates our list (in our case sql tables since we are now on SFE) every 10 minutes. We have been able to do this with 2 different mail servers (merak & smartermail) and if a better mail server comes along tomorrow I'm confident we can do it for that mailserver as well as long as it has an API of some sort. Using modusgate in your AS solution your kinda stuck using that mail server and can't quickly jump to other mail platforms without totally redoing your AS solution. Not trying to talk you out of using it, just giving you more things to consider in your quest for the best solution.

I shudder when I think of how much time (years) I've spent on perfecting our spam filtering and getting it to the point where we are happy with it. Luckily Roberto and his team have been responsive and listened to our suggestions and SFE is coming along just great!!!

Edited by WebGuyz

Moving SF as second layer anti spam : I tried many anti spam solution...

Wed, 01 Aug 2007 01:03:01 +0000

Author: tckoay
Subject: 6168
Posted: 01 August 2007 at 1:03am

I tried many anti spam solution & spent lots of $$$ to own it. If you looking for speed & min resources plus reasonable price, SF is your choice.

I'm using Vircom ModusLite as my first layer. (ModusGate is a very powerful AS but it cost a bomb to me) So I choose ModusLite which is unlimited user license. It have powerful network layer filtering features but it doesn't have SF's limbo & SFDB function. For my env, my customers are KING, they don't accept SF's Limbo & SFDB features as they always said I can receive the email in yahoo or google. Why your AS keep on blocking my incoming email.

Another reason that I'm using Modus sitting as first layer because it can communicate with my internal mail server to validate the recipient email address. As SF doesn't support SMTP vrfy so that currently it just accept whatever@mydomain.com, which I don't like to waste my bandwidth by receiving junk email in.

BTW, ModusGate is very powerful anti spam but costly. SF is chasing up too. The rest product like well know Bxxxxx, Txxxxx, Mxxxxx. It really wasted my investment. MailCleaner also not bad, IF you can effort to invest on hardware resources. I tested it but give up due to resources limitation.

For greylisting, my 2 cents is .... our lovely customer won't like it. It create more problem & cause email delay only. It not solve the problem but just delay it.

Moving SF as second layer anti spam : Just out of idle curiosity, what...

Tue, 31 Jul 2007 23:29:03 +0000

Author: WebGuyz
Subject: 6168
Posted: 31 July 2007 at 11:29pm

Just out of idle curiosity, what type of anti-spam are you running as a primary? I like the speed that SFE has and the only thing that I would consider putting in front of SFE would be a greylisting system. SA filter takes way too much in the way of CPU resources and we use it as a secondary only. But always looking for a better way to fight spam.

Thanks!

Moving SF as second layer anti spam : tckoay, What are you using as...

Tue, 31 Jul 2007 17:52:54 +0000

Author: atifghaffar
Subject: 6168
Posted: 31 July 2007 at 5:52pm

tckoay,

What are you using as your primary filter?

Note: if your primary filter is going to flush messages in batch, then the logstat spamfilter might tag all message in that batch as spam if one of them is considered spam.

We have this issue when using SFI as out-going spamfilter.

Moving SF as second layer anti spam : WebGuyz is right, you will definitely...

Tue, 31 Jul 2007 13:54:08 +0000

Author: sgeorge
Subject: 6168
Posted: 31 July 2007 at 1:54pm

WebGuyz is right, you will definitely want to add your mail server's ip to that list so that it is not blacklisted.

Also, as you mentioned, your SpamFilter is now whitelisting everything it receives, because all the mail it sees now is coming from the same i.p. address on a different port. In order to configure SpamFilter to not trust all mail originating from its own ip, you need to change the following setting to "1":

;by default SpamFilter will not allow any IP to relay thru it except for 127.0.0.1 (localhost). Change DoNotTrustSelfByDefault to 1 if you do not want localhost to be able to relay
DoNotTrustSelfByDefault=1

In addition, you would be wise to turn off the following filters in SpamFilter, as they are only effective when SpamFilter is located at the "edge" of your incoming mail gateway:

Reject if no Reverse DNS
MAPS
IPs
Country
Honeypots
SPF
SFDB

-Stephen

EDIT: You could also disable "Enable cached IP blocking", as it only works on the edge; but you don't have to, since using the setting that WebGuys mentioned will prevent your local mail server from being blocked.

Edited by sgeorge

Moving SF as second layer anti spam : In spamfilter.ini add your IP's...

Tue, 31 Jul 2007 13:13:41 +0000

Author: WebGuyz
Subject: 6168
Posted: 31 July 2007 at 1:13pm

In spamfilter.ini add your IP's separated by commas:

DoNotAddIPToHoneypot=xxx.xxx.xxx.xxx,xxx.xxx.xxx.xxx

This will stop your primary SF from getting blacklisted.

Edited by WebGuyz

Moving SF as second layer anti spam : I would like to install another...

Tue, 31 Jul 2007 09:43:13 +0000

Author: tckoay
Subject: 6168
Posted: 31 July 2007 at 9:43am

I would like to install another anti spam on top of the SF box. Then turn SF as the second layer of anti spam.

My first anti spam listen on port 25, then SF listen on port 26. Incoming email will go to 1st AS then SF.

How do I configure SF don't blacklist it own IP meantime still enjoy anti virus, bayensian filtering & so on. Meaning, I just want to turn off SF network layer filtering & blacklist function?

Now see SF seem to be treat it own IP as We Are Sender then ignore all the filter.

Thank you.