Mailscanner RBL check SPAM Flag

Questions and answers about how to do stuff
Post Reply
efagokan1
Posts: 24
Joined: 28 Mar 2022 05:57

Mailscanner RBL check SPAM Flag

Post by efagokan1 »

Hello

I use lists like SORBS strictly. If an email is marked as spam, I want it to go to the junk box. I did not see such a rule for emails with RBL installed. Spamassassin can do this, but Mailscanner did not see this setting. MailScanner does the RBL control.

What can I do about it?


Thanks.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

Question: How are you using the RBLs?

Are you using it at the postfix level? or at the spamassassin level?

If it is done by postfix, the mail will immediately be rejected and no message will be received.

If it is done by spamassassin, then you will have a record and a spamscore addition added to the message. If you are unhappy with the scoring, then you can edit your spamassassin local.cf to increase the scoring to something you are happier with.

Next question: How do you know you are using SORBS? That'll help me understand the answer to my first question.
efagokan1
Posts: 24
Joined: 28 Mar 2022 05:57

Re: Mailscanner RBL check SPAM Flag

Post by efagokan1 »

I'm doing it in MailScanner.conf. Should I do it directly in Spamassian?
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

Huh. I didn't realize that option was there in Mailscanner.conf!

Let me investigate further.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

efagokan1 wrote: 04 May 2023 19:22I want it to go to the junk box
Can you tell me what you mean by that?

EFA will mark a message as one of three things:
  1. Not Spam (pass it through)
  2. Spam (might be spam, but might not be)
  3. High Spam (definitely spam)
What your system does with the different types is configurable.

On my system, #1 gets delivered, #3 does not get delivered and #2 gets delivered, but with a modified subject telling the user that this might be spam.

How do you want your mail processed?
efagokan1
Posts: 24
Joined: 28 Mar 2022 05:57

Re: Mailscanner RBL check SPAM Flag

Post by efagokan1 »

Sure, I'll tell you. Emails stuck on RBL lists are not scored. Therefore they do not end up in the junk mailbox.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

So, if you want to receive the spam, then you need to disable the use of the RBL. Instead, use the RBLs inside spamassassin so they get a score instead of being blocked.

Any spam that gets delivered and is not scored properly can use used to train the bayesian filter.

- disable the use of the RBL in Mailscanner.conf
- enable the use of the RBL in spamassassins local.cf

Make sure that the spam handling option for spam (and maybe high scoring spam) in Mailscanner.conf includes store.
efagokan1
Posts: 24
Joined: 28 Mar 2022 05:57

Re: Mailscanner RBL check SPAM Flag

Post by efagokan1 »

How can I do it with spamassassin? can you show a few examples?
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

I am not 100% sure if this is correct, but try this:

1/ disable the use of the RBLs in /etc/MailScanner/MailScanner.conf

Code: Select all

Spam List =
2/ edit /etc/mail/spamassassin/mailscanner.cf and make sure that the following line is commented out so spamassassin will run the rbl checks.

Code: Select all

# skip_rbl_checks	1
3/ Make sure the spam actions is to "store" in MailScanner.conf so you can train efa4 to better recognize spam

Code: Select all

Non Spam Actions = store deliver header "X-Spam-Status:No"
Spam Actions = store deliver header "X-Spam-Status:Yes"
High Scoring Spam Actions = store header "X-Spam-Status:Yes"
Email is delivered, Spam is delivered and stored in EFA. High Spam is stored and not delivered. I also set a message header with the spam status that I can filter with the client email program. You may not need to set this header.

3/ let it run for a while and check the results.


That said, I am unsure what the first options does. I've turned it on. I suspect that it it will help flag spam that would otherwise get a low score and it might be a useful option to keep. We shall see.

Let me know how you get on.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

Well, that was quick!

Have a look at this:
Screenshot 2023-05-17 at 14.28.png
Screenshot 2023-05-17 at 14.28.png (160.56 KiB) Viewed 1511 times
These are the settings I put in my MailScanner.conf

Code: Select all

Spam List = BARRACUDA SORBS SPAMHAUS SPAMCOP
Spam Lists To Be Spam = 1
Spam Lists To Reach High Score = 2
This spam had a -8 score (non spam) but was found in the SORBS rbl list. Since I had set the 2nd option = 1, then it was flagged as spam even with the really low SA score. And, it was definitely spam even though the bayes filter didn't think so.

So now I should be able to catch spammy messages that were otherwise getting through my SA filter. Wonderful!

Now I will need to create a report that checks for "Listed in the RBL = Y" and "SpamAssassin Spam = N" so I can find potential messages that need retraining.
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

Here are the filters I am using for this report:
Screenshot 2023-05-17 at 14.37.png
Screenshot 2023-05-17 at 14.37.png (21.25 KiB) Viewed 1511 times
efagokan1
Posts: 24
Joined: 28 Mar 2022 05:57

Re: Mailscanner RBL check SPAM Flag

Post by efagokan1 »

pdwalker wrote: 17 May 2023 06:11 I am not 100% sure if this is correct, but try this:

1/ disable the use of the RBLs in /etc/MailScanner/MailScanner.conf

Code: Select all

Spam List =
2/ edit /etc/mail/spamassassin/mailscanner.cf and make sure that the following line is commented out so spamassassin will run the rbl checks.

Code: Select all

# skip_rbl_checks	1
3/ Make sure the spam actions is to "store" in MailScanner.conf so you can train efa4 to better recognize spam

Code: Select all

Non Spam Actions = store deliver header "X-Spam-Status:No"
Spam Actions = store deliver header "X-Spam-Status:Yes"
High Scoring Spam Actions = store header "X-Spam-Status:Yes"
Email is delivered, Spam is delivered and stored in EFA. High Spam is stored and not delivered. I also set a message header with the spam status that I can filter with the client email program. You may not need to set this header.

3/ let it run for a while and check the results.


That said, I am unsure what the first options does. I've turned it on. I suspect that it it will help flag spam that would otherwise get a low score and it might be a useful option to keep. We shall see.

Let me know how you get on.
Thanks a lot for the information.

How can I add Spamhaus, Sorbs, Barracuda or similar in this configuration file "/etc/mail/spamassassin/mailscanner.cf"?

Is the following correct?

Code: Select all

header        CUSTOM_LOOKUP    eval:check_rbl_txt('zen','zen.spamhaus.org.')
describe      CUSTOM_LOOKUP    Entries listed in SPAMHAUS RBL
score         CUSTOM_LOOKUP    3.0
User avatar
pdwalker
Posts: 1553
Joined: 18 Mar 2015 09:16

Re: Mailscanner RBL check SPAM Flag

Post by pdwalker »

They are already added in spamassassin.

You can see for yourself with the following command:

Code: Select all

grep -ri check_.*rbl /var/lib/spamassassin/.
Post Reply