EasySpamFigther 1.9

DirectAdmin Support

Administrator
Staff member
Joined
Feb 27, 2003
Messages
8,937
Hello,

I've released Easy Spam Fighter version 1.9.
This does a better job at correctly identifying the 2 types of reverse IP lookup failures.

1) Exim's check called
Code:
verify = reverse_host_lookup
was actually a forward-confirmed reverse IP lookup, where it does both a reverse IP lookup AND a forwarder lookup of that rDNS, to ensure the returned A record matches the sending IP.
As this is not always going to be true, I've flipped this around to give a -10 score if it's true, rather than +100 if it fails.
New variable:
Code:
EASY_FORWARD_CONFIRMED_RDNS = -10
2) The more basic rDNS is now using the simple
Code:
dnsdb{ptr=$sender_host_address}
and doesn't check the forward A lookup.
If this one fails, +100 is given, and this should drop the connection if the EASY_HIGH_SCORE_DROP is set to the default value of 100.

For efficiency, if the rDNS fails in #2, sets a variable (acl_m_no_reverse_dns), so that the FCrDNS in #1 isn't done.
#2 is run before #1.


3) Also changed, are the checks for 0 scores, so that lookups are done done at all.
- EASY_SPF_SOFT_FAIL=0 causes spf=fail and spf=softfail checks not to be run at all
- EASY_SPF_PASS=0 causes spf=pass not to be run
- EASY_NO_REVERSE_IP=0 prevents the dnsdb PTR rDNS lookup
- EASY_FORWARD_CONFIRMED_RDNS=0 prevents the forward-confirmed rDNS lookup (this is the slowest, as it needs 2 lookups, but rDNS from #2 may already be cached anyway)

John
 

Barend

New member
Joined
May 31, 2015
Messages
2
What is next?

Hello,

I've installed ESF because I hope it will help me prevent spam on forwarded and outgoing e-mail.
I've followed these instructions: http://help.directadmin.com/item.php?id=576

Is there a way to test if ESF is working now? I cannot find a log file, or any controls.

Regards,

Barend
 

DirectAdmin Support

Administrator
Staff member
Joined
Feb 27, 2003
Messages
8,937
Sorry for the late reply, just noticed your message as I'm posting an update regarding ESF 1.10.

You can tell if it's working by looking at the headers of your incoming emails.
ESF will add headers with the given scores for things like DKIM/SPF, etc..

John
 

DirectAdmin Support

Administrator
Staff member
Joined
Feb 27, 2003
Messages
8,937
Note, for anyone using the value
Code:
EASY_SPF_SOFT_FAIL==0
in order to prevent the full drop during a hard fail: spf=fail, this will no longer work in ESF version 1.14:
http://forum.directadmin.com/showthread.php?t=53908

Use:
Code:
EASY_SPF_FAIL=60
to prevent a full drop, and to instead add a 60 score to the total.
See the above thread for 1.14 for more info.

John
 
Top