Spam Suck

yes they do all kinds of ways i like filter about 200 porn sites and its hard to keep up with the ways they do the emails

You will never catch all spams without filtering 'real' mail also.. spam is done by people with a little bit of sense and therefore is done in ways to block you blocking them - images in most cases could cover up words and words ca use special characters incorrect spacing etc. the ways to get around the spam filters are unfortunately to easy.

Chris

I "slightly" disagree with you, Chris. We've been very successful with our "http://spamblocked.net/" service.

We've gone down from 10,000 spams per day to under 100.

While there might be a few false positives, they (the senders of false positives only) get sent to a nice page, to whitelist their email.

Jeff

You can certainly do well in catching spam, what I was trying to get across is, its quite simply impossible to block all spam.

You can get rid of the obvious spam - filters with a few off keywords get rid of most of it - 'enlargement' 'wife' 'husband' 'mortgage' 'pills' 'valium' 'viagra' 'weight' are keywords that would destroy most spam for users such as us in the web hosting industry... however they will always bypass it by using special characters, missing letters, images, etc

Basically, its not going to happen without compromising regular emails, and to be quite honest with you I would happily put up with small amounts of spam to allow anyone to contact me immediatly (without having to confirm any whitelists contacting me with a basic message that spam filter is blocking them etc)

Chris

ProWebUK said:

You can get rid of the obvious spam - filters with a few off keywords get rid of most of it - 'enlargement' 'wife' 'husband' 'mortgage' 'pills' 'valium' 'viagra' 'weight' are keywords that would destroy most spam for users such as us in the web hosting industry...

Click to expand...

And destroy the usability of email for clients in the medical field, researchers, people who need medication, or to discuss it, conversations about husbands, and wives, etc.

Over several years of testing we've found that carefully selected blocklists are much better than SpamAssassin for blocking spam, and for false positives as well.

We've also discovered that most people would rather not see spam than have it filtered to a folder where they still have to look at it.

A one year test of a server with fifteen domains on it (all users who wanted to be in the test), carefully selected blocklists resulted in only two false positives.

We offer, as I said, the option of using one or the other.

Jeff

jlasman said:

And destroy the usability of email for clients in the medical field, researchers, people who need medication, or to discuss it, conversations about husbands, and wives, etc.

Click to expand...

that would destroy most spam for users such as us in the web hosting industry...

Click to expand...

I noted that purposely and was considering placing a note stating it would vary depending on the circumstances aswell as the user itself.

jlasman said:

Over several years of testing we've found that carefully selected blocklists are much better than SpamAssassin for blocking spam, and for false positives as well.

Click to expand...

Not sure if i agree there at all, I guess it *can* although not always, there are often circumstances where a single IP address on a subnet is used for spam, and whole subnets get blocked... As you may or may not know, I will assume you do, its often very difficult to get yourself removed from block lists. and when an incident such as the one stated above occurs it *can* cause serious problems for you, your customers and other users of the subnet.. and take weeks before anything can get done. SpamAssasin, hardware firewalls etc will never get this problem. Also, based on the above that could lead to many more false "spam" messages being caught up.

jlasman said:

We've also discovered that most people would rather not see spam than have it filtered to a folder where they still have to look at it.

Click to expand...

With Mailscanner / spamassassin packages you wont get this problem - both are configurable can be modified and are set to work in no specific way - you control the software not the software controls you. With the packages we use there are 3 options (i think these 3 are correct - although the first and last are certinaly correct) - tag as spam and deliver, bounce back to sender / dont deliver - drop completely with no bounce

As a final comment, spamassassin can be 'trained' to learn what is classified as spam and what is not... to start with its not the most amazing tool although after some learning i assume it can turn quite useful - the good thing about software and hardware maintained by yourself is you can decide if it goes through or not, and also decide who is and who isn't allowed to mail you...

Chris

Hi,

Where's the list of all words filtered in DA located?

Can anyone maybe provide me with a list of all words?

Seems like they're spelling viagra as Via0prga or ViaMNrga etc...and so many of these Widow, husband, wife letters...

Any help would be appreciated.

Also seems like ClamAV and MailScanner isnt doing anything.

Not sure if i agree there at all, I guess it *can* although not always, there are often circumstances where a single IP address on a subnet is used for spam, and whole subnets get blocked... As you may or may not know, I will assume you do, its often very difficult to get yourself removed from block lists. and when an incident such as the one stated above occurs it *can* cause serious problems for you, your customers and other users of the subnet.. and take weeks before anything can get done. SpamAssasin, hardware firewalls etc will never get this problem. Also, based on the above that could lead to many more false "spam" messages being caught up.

Click to expand...

I think this is the part that most people don't seem to understand. All the RBL's and alike are BS; other than those that JUST test open-relays, (which have a purpose) RBL's can be problematic.

Simple effective solution, we need a REAL reverse mail lookup similar to RDNS, and we need ONE entity to run a well thought-out RBL that is effective. It needs strict rules but is not faceless and is forgiving so that real legit emails are being recieved.

my 2 cents

We choose very carefully selected RBLs, which you'll get to see soon enough as we finish our open version of our exim.conf file and post it on this forum.

What you won't see, of course, is that we change them often, as necessary.

And our handcrafted error messages are user friendly and direct anyone who gets caught in them to a page where they can whitelist themselves.

During testing last year, with a much more draconian system for blocklisting (before we started writing one for exim) we caught two legitimate senders in our blocklists, and we did whitelist them. (Perhaps three, but I can only remember two right now.)

This year so far, since we've refined the lists we use and the way we use them, we've had no legitimate requests to be whitelisted.

We've had a few people tell us to remove our block on email addresses we don't host, which leads us to believe that either someone else has found our destination page and is sending people to it rather than writing their own, or that some spammers are trying to use us for relaying, and then asking to be whitelisted when we don't allow that.

If you're willing to test our new exim.conf file I think you'll be presently surprised.

Jeff

jlasman said:

We choose very carefully selected RBLs, which you'll get to see soon enough as we finish our open version of our exim.conf file and post it on this forum.

If you're willing to test our new exim.conf file I think you'll be presently surprised.

Jeff

Click to expand...

Any idea when this will be available? I'll admit I'm eager to try this out. If you want a tester, I'll volunteer.

John

John, I'm going to finish the "cleanup" and the documentation this weekend. It still has a lot of old "Exim3" settings in it, documented out, true, but they don't belong there and I don't want them in anything I go public with.

And I have to finish documenting the various files I've aded, what they do, and what you have to do to use them.

Jeff

Sounds great, can't wait

I'll try and get the interface for it (whatever it may be) done for this release, assuming there is a safe way to turn off the interface for those who havn't updated their exim.conf's yet.

John

I'll be sending you some info by email in a moment on the files I need, and what I expect to find in them.

Jeff