4 ms·

Where do you get this 80%+ spam coming from MS etc from? My mailserver still gets heaps and heaps of spam from random IP's that an RBL helps block. I use rspa

Where do you get this 80%+ spam coming from MS etc from? My mailserver still gets heaps and heaps of spam from random IP's that an RBL helps block. I use rspamd which takes a number of RBLs into account. Yes, RBL isn't the only thing it uses (there's Bayes, Neural Net, dmarc/dkim/sfp, razor/pyzor as well as others). Very little spam comes from the big players. I DO see a lot of spam attempts from *.onmicrosoft.com domain names, but no one legit sends from that domain so that's just blocked outright. If the argument is 80%+ of email is _handled by_ MS/Google etc then yea, I agree. But us losers out here still doing our own mail still see masses of spam from random IPs that RBLs still help block. All that said, seeya SORBs. Your data was always hot garbage and so full of false positives as to be useless.

PreInternet01 2y ago
Strict SPF enforcement will get rid of most of the random-IP spam. Then, you'll identify a few hosting providers that actually get SPF right, but are very easy to block based on rDNS or name servers. And then it's really mostly Amazon/Google/Microsoft and assorted transactional/list SaaSes...
- muppetman 2y ago
  I disagree. Looking at just a random spam I have here, I see it passed both SPF and DKIM happily. But it was marked as spam in HostKarma, Spamhaus, Truncate and flagged as Bulk by Razor. So I dropped it. Looking at heaps of my attempted Spam emails I see the same. It seems most spammers setup SPF before attempting, or are hijacking legit sites/mailservers to send the spam. Pretty much the only Spam I find I reject based on DMARC as well is just the "I hacked your webcam" blackmail spam that tries to "prove" they hacked you by spoofing my email domain. I think if I disabled all RBLs the other huristics rspam gives me would still catch 90% of the Spam, but the RBLs certainly help me still catch 99.9% of the Spam attempts I recieve.

PreInternet01 2y ago

Strict SPF enforcement will get rid of most of the random-IP spam. Then, you'll identify a few hosting providers that actually get SPF right, but are very easy to block based on rDNS or name servers. And then it's really mostly Amazon/Google/Microsoft and assorted transactional/list SaaSes...

muppetman 2y ago
I disagree. Looking at just a random spam I have here, I see it passed both SPF and DKIM happily. But it was marked as spam in HostKarma, Spamhaus, Truncate and flagged as Bulk by Razor. So I dropped it. Looking at heaps of my attempted Spam emails I see the same. It seems most spammers setup SPF before attempting, or are hijacking legit sites/mailservers to send the spam. Pretty much the only Spam I find I reject based on DMARC as well is just the "I hacked your webcam" blackmail spam that tries to "prove" they hacked you by spoofing my email domain. I think if I disabled all RBLs the other huristics rspam gives me would still catch 90% of the Spam, but the RBLs certainly help me still catch 99.9% of the Spam attempts I recieve.