EasySpamFigther 1.9

[DirectAdmin Support]

Hello,

I've released Easy Spam Fighter version 1.9.
This does a better job at correctly identifying the 2 types of reverse IP lookup failures.

1) Exim's check called

verify = reverse_host_lookup

was actually a forward-confirmed reverse IP lookup, where it does both a reverse IP lookup AND a forwarder lookup of that rDNS, to ensure the returned A record matches the sending IP.
As this is not always going to be true, I've flipped this around to give a -10 score if it's true, rather than +100 if it fails.
New variable:

EASY_FORWARD_CONFIRMED_RDNS = -10

2) The more basic rDNS is now using the simple

dnsdb{ptr=$sender_host_address}

and doesn't check the forward A lookup.
If this one fails, +100 is given, and this should drop the connection if the EASY_HIGH_SCORE_DROP is set to the default value of 100.

For efficiency, if the rDNS fails in #2, sets a variable (acl_m_no_reverse_dns), so that the FCrDNS in #1 isn't done.
#2 is run before #1.


3) Also changed, are the checks for 0 scores, so that lookups are done done at all.
- EASY_SPF_SOFT_FAIL=0 causes spf=fail and spf=softfail checks not to be run at all
- EASY_SPF_PASS=0 causes spf=pass not to be run
- EASY_NO_REVERSE_IP=0 prevents the dnsdb PTR rDNS lookup
- EASY_FORWARD_CONFIRMED_RDNS=0 prevents the forward-confirmed rDNS lookup (this is the slowest, as it needs 2 lookups, but rDNS from #2 may already be cached anyway)

John

 

[Barend]

What is next?

Hello,

I've installed ESF because I hope it will help me prevent spam on forwarded and outgoing e-mail.
I've followed these instructions: http://help.directadmin.com/item.php?id=576

Is there a way to test if ESF is working now? I cannot find a log file, or any controls.

Regards,

Barend

 

[DirectAdmin Support]

Sorry for the late reply, just noticed your message as I'm posting an update regarding ESF 1.10.

You can tell if it's working by looking at the headers of your incoming emails.
ESF will add headers with the given scores for things like DKIM/SPF, etc..

John

 

[DirectAdmin Support]

Note, for anyone using the value

EASY_SPF_SOFT_FAIL==0

in order to prevent the full drop during a hard fail: spf=fail, this will no longer work in ESF version 1.14:
http://forum.directadmin.com/showthread.php?t=53908

Use:

EASY_SPF_FAIL=60

to prevent a full drop, and to instead add a 60 score to the total.
See the above thread for 1.14 for more info.

John