Re: [Exim] SPAM problems : reject by X-Mailer?

Startseite
Nachricht löschen
Nachricht beantworten
Autor: Glenn Carver
Datum:  
To: Rory Campbell-Lange
CC: Alan J. Flavell, Exim users list
Betreff: Re: [Exim] SPAM problems : reject by X-Mailer?
>Hi Glenn, thanks for the info.
>
>How do you integrate dcc into exim? Can it play with exiscan?


I don't use exiscan myself so I'm not sure.

I tried configuring spamassassin to use DCC first, which you are
supposed to be able to do, but it wasn't very reliable. For reasons I
couldn't track down, sometimes SA would manage to talk to the DCC
servers but most of the time it wouldn't. It seemed to be a problem
of spamd talking the right way to dccproc.

In the end I added another router to exim so that it first routes
through SA, then it routes through DCC, which works every time. This
means each message might go through exim 3 times if it's checking for
spam but I have a whitelist set up so that only senders I don't trust
go through SA and DCC. The messages are scored by SA and DCC and
then my exim filter file decides whether to reject them or not.

One slight headache is that DCC needs it's own whitelists and if
you're running SA which also might need whitelists this is alot of
maintenance. So I've added whitelisting at the router stage of exim
so that SA & DCC only run if senders don't match. This isn't perfect
as I'd like to check sending host rather than sender address but I've
not figured out how to do that yet in the router!

If you were using SA within exiscan then that would remove one pass
through exim.

I can send you the config/filter file details if you're interested.

Glenn


p.s. I only get the exim-users digest, so apologies if my reply was delayed.

>
>Thanks,
>Rory
>
>
>On 13/01/04, Glenn Carver (Glenn.Carver@???) wrote:
>> I've also been getting a lot of spam mail like this, which gets past
>> spamassassin.
>>
>> I've since starting using DCC (http://www.dcc-servers.net/dcc/) as a
>> second pass after spamassassin and it's been successful at getting
>> rid of these spam messages. Not a particularly lightweight piece of
>> software but with DNSBL, spamasssassin and DCC, our spam intake is
>> now virtually zero.
>>
>> I would caution against blocking on a Mailer.
>--
>Rory Campbell-Lange
><rory@???>
><www.campbell-lange.net>