Forums & Blog

I have been struggling to find an answer to this problem and hope someone might help. I have one or two domains, each which use the default system settings for filtering mail, that receive far more SPAM than other domains on our system. Spot checking some of the messages that get through, some clearly come from IPs listed in a couple of RBLs used. The SPAM weight for the messages from SmarterMail is generally zero. It's as if the RBLs have no effect on the incoming messages for these accounts. What's curious to me is that accounts on other domains are receiving virtually no SPAM using the same settings. I have checked - the users also have default settings. Is it possible that somehow a domain would be bypassed in the SPAM filtering process? Or can this only be only explained by these particular accounts receiving far more traffic? Thanks for any input!

On the messages that make it through, that have a weight of 0, what does the X-SmarterMail-Spam header say?

Do you  see a X-SmarterMail-TotalSpamWeight: 0 (Authenticated) type line?

 

What this sounds like is that the user's or domain's trusted senders list is letting through the spam.

Yes, they have the X-SmarterMail-Spam line in the header. Below is a typical header (I've blanked out the recipient's email to be safe). We are not using SpamAssasin due to drain on performance, but have these other SPAM Checks:

 

• Baysian Filtering
• Domain Keys
  
• SPF
  
• Reverse DNS
  
• RBL: cbl.abuseat.org
  
• RBL: zen.spamhaus.org
  
• RBL: SpamCop
  

 The sample message header is below. Thanks,

 

Return-Path: <noreply@camodeer.org>
Received: from mail.sallowduck.org [69.51.26.14] by mail.syzzle.com with SMTP;
   Fri, 15 Aug 2008 12:12:37 -0400
Received: by mail.camodeer.org (qmail 412 by uid 77) id hkml7m01g745; Fri, 15 Aug 2008 12:08:58 -0400 (envelope-from <noreply@camodeer.org>)
Date: Fri, 15 Aug 2008 12:08:48 -0400
From: "Government Grant Source" <noreply@camodeer.org>
Subject: Need help with your money problems?
To: beth@allfriendspetcare.com
Message-ID: <p_53gzwLKBhV1LSbbijhRA@camodeer.org>
Mime-Version: 1.0
Content-Type: text/html; charset=us-ascii;
Content-Transfer-Encoding: 8bit
Content-Disposition: inline
X-SmarterMail-Spam: SPF_Pass, DK_None
X-SmarterMail-TotalSpamWeight: -5

 Unfortunately, there isn't much you can do there. Those spammers are passing SPF and not failing anything. There is no trusted senders issue, so there is no easy fix.

Which I guess may be the ultimate answer, but any idea why two domains setup with identical settings (same for the accounts) would get radically different results? Obviously they may not be receiving the exact same SPAM, but it just seems odd one domain is so much worse off. I can see messages being blocked, just not on emails coming into the affected domains. Maybe it's just a matter of them getting slammed. Just seems strange. Thanks

In this case I would recommend submitting the spam to your RBL lists. Those lists are only as good as the submissions.

 

I would tend to agree with your orignal post. I have two domains that did this, one is now ok... I am wondering whether the spam settings are kicking in to send it to low,med,high, and perhaps when I re saved the settings they then took affect.... is this possible? I migrated all my domains recently from another server, could the settings not quite have saved themselves properly when I moved everything?

Good point and we are beginning to do so. I have tested the SpamHaus RBL and it appears that all domains are processing the filters, so I guess it's simply that a couple of these users have been exposed suddenly.