3 ms·

How do you handle spam filtering for self hosted servers? I know there are black lists for SMTP servers, but I mean the content based filters that are updated b

How do you handle spam filtering for self hosted servers? I know there are black lists for SMTP servers, but I mean the content based filters that are updated based on recent spam signatures?

geocrasher 7y ago
I run a few servers that use Virtualmin + Postfix. I'm militant about outbound mail, and I make sure my accounts don't get compromised. If my mail queue reaches a certain size, I get notified and I go mop up the mess. Most recently it was an unprotected form that wasn't linked to, but existed. As for inbound spam, I can use RBL's but the most effective thing has been to block email servers that have rDNS that is either mismatched or nonexistent. I also host at a provider that isn't known for having their IP's on the "forever banned" lists.
- indigo945 7y ago
  > As for inbound spam, I can use RBL's but the most effective thing has been to block email servers that have rDNS that is either mismatched or nonexistent. This is also a recipe for never receiving mail from the SMB you do business with. (The same is true for enforcing SPF hard fails, unfortunately.) If you really want to be smart about this, use an SMTP soft error (greylisting) or an SMTP greeting pause. This effectively singles out spam bots, while leaving your regular mail traffic unaffected.
mark242 7y ago
Speaking as someone who runs a commercial antispam SAAS, content filtering is increasingly irrelevant, and isn't nearly as effective as reputation filtering or bayesian classification.
- mgamache 7y ago
  Bayesian classification is what I mean by spam 'signatures'. You run your own classifier?
- stevekemp 7y ago
  Back in the day I ran an anti-spam service, users would point their MX to my server(s), I'd do the filtering and pass on valid mails to their real hosts. It was a great learning experience, and I got to see a lot of volume. Sadly I never had enough customers to make the jump to the big-leagues, but it was fun. (I'd do proper SMTP-time rejection, but also archive rejected mails in a database for 30 days. Letting you browse / search through the rejected stuff - just in case I made a mistake, and also to see how good I was doing.) Even then content-scanning was not the best, but I used a lot of heuristics and I was quite proud of some of them. For example I "defeated" fast-flux hosts, via heuristics to lookup the number of addresses for a domain. Even large domains such as gmail only have 1-4 address-records, though of course their anycast and multiplexed. If you got a mail from a domain with 7+ MX records it was 99% spam.) At one point I documented damn near everything, after I'd shut down, but it seems I left the domains I used expire. I should see if I can dig out copies. (I used qpsmtpd as my core, and wrote a ton of glue code and custom plugins. Later the qpsmtpd-proxy was ported to javascript as Haraka - but I didn't covert my code even as I ported some plugins back.)
h1d 7y ago
rspamd works pretty well for me.
dmoo 7y ago
A million settings, but ASSP in front of postfix has worked well for me for quite a while.

How do you handle spam filtering for self hosted servers? I know there are black lists for SMTP servers, but I mean the content based filters that are updated based on recent spam signatures?

geocrasher 7y ago

I run a few servers that use Virtualmin + Postfix. I'm militant about outbound mail, and I make sure my accounts don't get compromised. If my mail queue reaches a certain size, I get notified and I go mop up the mess. Most recently it was an unprotected form that wasn't linked to, but existed. As for inbound spam, I can use RBL's but the most effective thing has been to block email servers that have rDNS that is either mismatched or nonexistent. I also host at a provider that isn't known for having their IP's on the "forever banned" lists.

indigo945 7y ago
> As for inbound spam, I can use RBL's but the most effective thing has been to block email servers that have rDNS that is either mismatched or nonexistent. This is also a recipe for never receiving mail from the SMB you do business with. (The same is true for enforcing SPF hard fails, unfortunately.) If you really want to be smart about this, use an SMTP soft error (greylisting) or an SMTP greeting pause. This effectively singles out spam bots, while leaving your regular mail traffic unaffected.

mark242 7y ago

Speaking as someone who runs a commercial antispam SAAS, content filtering is increasingly irrelevant, and isn't nearly as effective as reputation filtering or bayesian classification.

mgamache 7y ago
Bayesian classification is what I mean by spam 'signatures'. You run your own classifier?
stevekemp 7y ago
Back in the day I ran an anti-spam service, users would point their MX to my server(s), I'd do the filtering and pass on valid mails to their real hosts. It was a great learning experience, and I got to see a lot of volume. Sadly I never had enough customers to make the jump to the big-leagues, but it was fun. (I'd do proper SMTP-time rejection, but also archive rejected mails in a database for 30 days. Letting you browse / search through the rejected stuff - just in case I made a mistake, and also to see how good I was doing.) Even then content-scanning was not the best, but I used a lot of heuristics and I was quite proud of some of them. For example I "defeated" fast-flux hosts, via heuristics to lookup the number of addresses for a domain. Even large domains such as gmail only have 1-4 address-records, though of course their anycast and multiplexed. If you got a mail from a domain with 7+ MX records it was 99% spam.) At one point I documented damn near everything, after I'd shut down, but it seems I left the domains I used expire. I should see if I can dig out copies. (I used qpsmtpd as my core, and wrote a ton of glue code and custom plugins. Later the qpsmtpd-proxy was ported to javascript as Haraka - but I didn't covert my code even as I ported some plugins back.)

h1d 7y ago

rspamd works pretty well for me.

dmoo 7y ago

A million settings, but ASSP in front of postfix has worked well for me for quite a while.