Spam Challenge-Response system

Moises Morales moisesm at theace.net
Fri Apr 10 12:53:39 MDT 2009


This is what I have found very effective (doing them all in that order):

1.- Reject any attempt to deliver an email if the other host does not have a reverse DNS (just on that I reject about 40 thousand email delivery attempts).
2.- Check if the other host dns has a dynamic looking address (at least 3 numbers separated by dashes).  Just on that I reject 2 thousand connections.  I use milter-regex for this and the above.
3.- Using SpamAssassin, enable 'network tests', so that URL's on the email itself are parsed and compared against multiple URIBL databases.  This is very effective, because it doesn't matter who sends the email, it checks the content of the email for urls.  On this about 400 are rejected.  Increase the scores for URIBL tests in spamassassin (I have them at 10.0 each).
4.- Finally, configure SpamAssassin so that it rejects the emails on the fly, while on the email delivery transaction.  If you use procmail to delivery the mail to SpamAssassin that is too late, you already accepted the email and won't be able to return it (most likely because the 'from' is fake).  For this I use spamass-milter.

I've been using actively the same email for the last 11 years, and I only get about 1-2 spams a day (and they are already tagged as spam by spamassassin).


Moises Morales.
 

>>> <jessie at confettiantiques.com> 4/9/2009 4:38 PM >>>
> On Thu, Apr 9, 2009 at 4:22 PM, Jessie Morris
> <jessie at confettiantiques.com>wrote:
>>> Just out of curiosity, how many spam emails do you guys receive a week?
>>>
>
> I have received 100 spam emails today, and SpamAssasin has caught 66,577
> since I started using it. I'm not sure how long I've been using it
> because the dates on the spam emails range from 1970 to 2105.
>
> --Dave
>
> /*
> PLUG: http://plug.org, #utah on irc.freenode.net
> Unsubscribe: http://plug.org/mailman/options/plug 
> Don't fear the penguin.
> */
>

Huh. I've received 16 thousand in the past four days... Guess that's what
happens when you have a pretty big account on Ebay/Amazon.



/*
PLUG: http://plug.org, #utah on irc.freenode.net
Unsubscribe: http://plug.org/mailman/options/plug 
Don't fear the penguin.
*/




More information about the PLUG mailing list