Forums & Blog

I have been running Smartermail 4.3 for several months and it works great!  All of a sudden, with no config changes, Spam has been sneaking thru for all domains.  Where i was seeing 5 a day, now i am seeing 50 a day.  Any ideas what could cause this? 

Spam morphs all the time, as well as volumes, so is a constant battle.  I can well recommend eWall from sssolutions.net which is an extremely cost effective SMTP proxy that has advanced scripting and filtering functionality.  Since we implemented it we are now zapping 82.5% of all mail before it even gets to SM - which significantly reduces load on SM.  When you see new spam's you just simply add to your eWall filters and it'll work across all domains hosted on your server(s).

 please see my post here:

http://www.smartertools.com/forums/p/18988/49161.aspx#49161

 I find it incredibly hard to believe that after months of working spectacularly, that all of a sudden, with no changes, i should be flooded with spam again.  Has nobody seen this phenomenon recently?  is it possible that one of the RBL sites i am using has shutdown?  i use DSBL Standard, Spamcopy and SpamHaus SBL+XBL.  

 I know i'm grasping for straws, but i can't see needing some additional addon, when this has worked so well all this time....

did you click my post?

nobody should be using sbl+xbl you should be using zen...

i'm not even sure who dsbl standard and spamcopy are... did you mean spamcop? you should do some reserach on false positives and percentages:

http://www.dnsbl.com/

seriously look at my post... you only need those 5.

spamcop

zen

and the 3 others uceprotect:

http://stats.dnsbl.com/ 

Ok, i finally was thinking smart and checked the delivery logs.  The day it started, at 4am, this msg started appearing and has not stopped.  fyi, i have rebooted the server, to no avail.  All services appear to be running and i was NOT making anything except alot of ZZZZZsss at 4am that day...

Unable to run SpamAssassin spam checks on server 127.0.0.1:783: System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:783
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)
   at SmarterTools.SmarterMail.MailStore.Spam1.SpamAssassinClient.InternalCheck(SpamAssassinVars sav)

Spam does suck though because if your rule says delete, it still is processed by your mail server.   The load is terrible.

Sorry, that was a typo.  i use.....

list.dsbl.org

bl.spamcop.net

sbl-xbl.spamhaus.org

And zen.spamhaus.org 

But the point was, it worked perfect, until recently.  Check my post out from 1/2 hour ago.  there is a definite system issue based on my logs.  i just don't know why.  i ran netstat and confirmed that nothing is listening at port 783.  This started all on it's own at 4:30am.  i have restarted the server, still happening.....

 this is redundant:

sbl-xbl.spamhaus.org

And zen.spamhaus.org

zen= sbl+xbl + other....

this could cause timeouts and maybe even excessive contacting to their server

list.dsbl.org has timed out for us in the past, and it sometimes throws false positives. if you use the 5 i suggested they cover all of the list.dsbl.org's as well 

 Ok i will remove one of them.  I just added the Zen.Spamhaus.org this morning. SO it is unrelated.  As is all of this discourse.... 

 The real issue is this log entry that i posted an hour ago.  AND that is what i need input on...  This error logs hundreds of times a day since my problem started.

 Unable to run SpamAssassin spam checks on server 127.0.0.1:783: System.Net.Sockets.SocketException: No connection could be made because the target machine actively refused it 127.0.0.1:783
   at System.Net.Sockets.Socket.DoConnect(EndPoint endPointSnapshot, SocketAddress socketAddress)
   at System.Net.Sockets.Socket.Connect(EndPoint remoteEP)
   at SmarterTools.SmarterMail.MailStore.Spam1.SpamAssassinClient.InternalCheck(SpamAssassinVars sav)

i dont use SA... make sure however... that SA is on your whitelist (the ip... like 127.0.0.1)...

then make sure if you use windows firewall that SA is allowed. also i think you have to adjust the delay between messages... by default its like 10-15 seconds which is fine for SA... ours is set to 1 second since we do not use SA.

what you could try... is set zen, spamcop and all 3 uceprotects to 5... then if 5+5=10 flag as spam low... then have spam low go to junk folder. make sure bayensian is on... thats all we have and we only get a few messages a day but we dont regulate these accounts so... spam assassin might be helping hehe.

i'm not really sure from here on what to help you with. i have phrase lists but smartertools does not use them. -jer