Re: [PLUG] Spam programs

[George Theall <theall@tifaware.com>]

On Thu, Oct 21, 2004 at 04:19:07PM -0400, Doug Crompton wrote:

> I am currently using an older version of SpamAssassin and I find I have to
> generally run it with the -L option, discarding outside checks. The
> ORBS/DNSBL - orsirusoft and dorkslayers checks seems to be meaningless at
> this point. They report just about everything as open relay! Even
> Navy.mil!

Osirusoft shut down their RBL late summer of last year (see
<http://relays.osirusoft.com/>); ditto with Dorkslayers (see
<http://www.dorkslayers.com/>).

Versions of Spamassassin starting with 2.60 don't support using those
resources. You can either upgrade (3.0.0 is current) or adjust local.cf
to ignore those specific blacklists; eg,

------- start of cut text --------------
score RCVD_IN_ORBS 0.0
score RCVD_IN_OSIRUSOFT_COM 0
score X_OSIRU_DUL 0
score X_OSIRU_DUL_FH 0
score X_OSIRU_OPEN_RELAY 0
score X_OSIRU_SPAMWARE_SITE 0
score X_OSIRU_SPAM_SRC 0
------- end ----------------------------

> Can I get comments from others as to what you are using to battle spam
> and your success or lack thereof?

I currently use a three-tiered approach:

1) I use my firewall to deny access completely to known spammers and
pretty much all of China and Korea. 

2) I use sendmail hacks to block hosts using bad hellos or in either the
Spamhaus SBL or SORBS dnsbl blacklists and to require reverse DNS. 

3) I use an up-to-date Spamassassin in conjunction with periodic
rules_du_jour updates to filter whatever gets through. 

I don't bother to count mail blocked by 1), but 2) stops currently
around 200 messages a day and 3) sends 15-20 per day to a spam folder. 
This works well for me and the handful of accounts I provide service
for.  I generally get perhaps 1 spam message a day that makes its way
into my inbox, and I can't remember the last time I found something
erroneously blocked / filtered (and yes, I do check). 

Btw, especially in the area of spam fighting, things change
*constantly*; you really ought to try to stay up to date. 

George
-- 
theall@tifaware.com

Attachment: pgpfZWpwrHJmQ.pgp
Description: PGP signature