Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 930 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Massive problem with SMTP proxy / wrong spam filtering

cr4sh3r
Hi folks,

since tonight nearly every incoming email is marked as spam, someone else got the same problem?

Viewing the SMTP proxy log says e.g.

2008:06:18-10:15:03 (none) cffd[5833]: id="105K" severity="info" sys="SecureMail" sub="smtp" name="email blocked, spam detected" srcip="1.2.3.4" from="cr4sh3r@astaro.org" to="cr4sh3r@astaro.de" subject="Mail from ASG" messageid="156488" size="2341" engine="4" spamscore="10" action="freeze" 


Viewing the SMTP engine log says e.g.

10:15:02 (none) exim[5770]: 2008-06-18 10:15:02 SMTP connection from [1.2.3.4]:60845 (TCP/IP connection count = 1)
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 [pid 6632] [1.2.3.4] F= Untrusted message
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 [pid 6632] [1.2.3.4] F= R= Verifying recipient address
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 [pid 6632] [1.2.3.4] F= R= Performing default RBL checks
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 [pid 6632] [1.2.3.4] F= R= Performing dialup RBL checks
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 [pid 6632] [1.2.3.4] F= R= Greylisting: skipped for this domain
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 1K8soo-0001iy-Gr cr4sh3r@astaro.org H=mail.astaro.de (mail.astaro.de) [1.2.3.4]:60845 P=esmtp S=2023 id=a894931e8636a2f9918b9ceb5812a7d3@email.astaro.org
2008:06:18-10:15:02 (none) exim[6632]: 2008-06-18 10:15:02 SMTP connection from mail.ncp-e.com (mail.ncp.de) [1.2.3.4]:60845 closed by QUIT
2008:06:18-10:15:02 (none) exim[6633]: 2008-06-18 10:15:02 1K8soo-0001iy-Gr => cr4sh3r@astaro.de F= P= R=cff_route T=cff_smtp H=127.0.0.1 [127.0.0.1]:1234
2008:06:18-10:15:02 (none) exim[6633]: 2008-06-18 10:15:02 1K8soo-0001iy-Gr Completed



The IP and the destination/source domains are changed of course


I`m still using ASG 7.101, untill tonight there were never problems with that and it it not one special domain, far from it, it did not find a domain that was NOT blocked.

There were no changes made, I looked into the daily executive report, no one was logged in since a few days and as said, the problem excists since tonight.

Maybe a problem with one of the rbl providers, did someone hear/read anything or got the same problem.

To let you know about my smtp configurations:

RBL: Use recommanded and block dialup hosts
Heuristic scanner: use, yes - warn threshold 3, quarantine threshold 6, perform url check, yes

Expression filter: some set, like vgiara, ....

Adavanced anti spam: nothing used



Thx, Andreas


This thread was automatically locked due to age.
Parents
  • 0
    After upgrading to 7.201 the problem was still not solved, but disabling the heuristic and enebling it again brought the wished effect and solved this issue
  • 0 in reply to cr4sh3r
    Hoped too soon the problem is solved, it still exists! If I turn off the heuristic scanner, the mails are regulary forwarded, but I can not do this, because 8 of 10 emails are spam and my collegues will kill me. Turning heuristic back on again, ALL incoming emails get a spamscore of 10 and are hold in quarantine (threshold is 6 normally). 

    Please help, I need a solution
Reply
  • 0 in reply to cr4sh3r
    Hoped too soon the problem is solved, it still exists! If I turn off the heuristic scanner, the mails are regulary forwarded, but I can not do this, because 8 of 10 emails are spam and my collegues will kill me. Turning heuristic back on again, ALL incoming emails get a spamscore of 10 and are hold in quarantine (threshold is 6 normally). 

    Please help, I need a solution
Children
  • 0 in reply to cr4sh3r
    That is a wierd one, for sure.  If you're running a commercial license, I recommend you contact support and get a case started.

    CTO, Convergent Information Security Solutions, LLC

    https://www.convergesecurity.com

    Advice given as posted on this forum does not construe a support relationship or other relationship with Convergent Information Security Solutions, LLC or its subsidiaries.  Use the advice given at your own risk.

Cookie Information Banner