Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 24 replies
  • Subscribers 1 subscriber
  • Views 5805 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Significantly more mails quarantined with 8.200 SMTP proxy

MarCow
I'm using the latest 8.200 soft release as a software appliance install on an ASG 220.  Since the upgrade, I'm seeing 2-3 times more legitimate mail being quarantined compared to 8.103.  As one example, notification emails from nytdirect@nytimes.com were never quarantined by 8.103, but are always quarantined by 8.200.  I didn't see anything in the release notes that suggested a major revamp of the anti-spam SMTP filtering, but maybe I missed something?  I realize I could add all the exceptions into the proxy, but this could be quite time-consuming.  Also, selecting "Release and report as false positive" doesn't appear to allow emails from that same address through next time around, but I could just be misunderstanding the meaning of that option.

Anyone else seeing the same thing?

Best regards,
Martin.


This thread was automatically locked due to age.
  • 0
    Martin, what is in the log file SMTP when this happens?  Is it the same thing for the other items?

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Bob - I'll cross-reference the log with one of these items the next time it happens and let you know.  Thanks.

    Martin.
  • 0
    Another of the NYTimes alert emails arrived last night at 19:21, and was quarantined as seems to always be the case in 8.200 (but not 8.103).  I've included the relevant SMTP Proxy log excerpt below.  I assume the relevant piece is this; "ctasd reports 'Bulk'".  I wonder why this did not happen in the previous release.  There are other mail items that are being quarantined in 8.200 that did not get quarantined under 8.103, and that include that same message.

    I can easily go and add exceptions for the relevant domains, but it's interesting that the behavior has changed; I expect other SMTP proxy users would also be seeing a lot more mail landing in quarantine compared to 8.103.

    2011:08:01-19:21:14 gateway exim-in[7526]: 2011-08-01 19:21:14 SMTP connection from [216.146.33.79]:63801 (TCP/IP connection count = 1)
    2011:08:01-19:21:14 gateway exim-in[16191]: 2011-08-01 19:21:14 H=mxout-079-ewr.mailhop.org (mail-12-ewr.dyndns.com) [216.146.33.79]:63801 Warning: cowley.us profile excludes AV scan: Skipping SMTP inline AV scan for this message
    2011:08:01-19:21:14 gateway exim-in[16191]: 2011-08-01 19:21:14 [216.146.33.79] F= R= Verifying recipient address with callout
    2011:08:01-19:21:14 gateway exim-in[16191]: 2011-08-01 19:21:14 1Qo1nO-0004D9-0s ctasd reports 'Bulk' RefID:str=0001.0A02020B.4E3734EA.004E,ss=3,re=0.000,fgs=0
    2011:08:01-19:21:14 gateway exim-in[16191]: 2011-08-01 19:21:14 1Qo1nO-0004D9-0s nytdirect@nytimes.com H=mxout-079-ewr.mailhop.org (mail-12-ewr.dyndns.com) [216.146.33.79]:63801 P=esmtp S=2343
    2011:08:01-19:21:14 gateway exim-in[16191]: 2011-08-01 19:21:14 SMTP connection from mxout-079-ewr.mailhop.org (mail-12-ewr.dyndns.com) [216.146.33.79]:63801 closed by QUIT
    2011:08:01-19:21:15 gateway smtpd[7171]: QMGR[7171]: 1Qo1nO-0004D9-0s moved to work queue
    2011:08:01-19:21:20 gateway smtpd[16193]: SCANNER[16193]: 1Qo1nU-0004DB-Bn nytdirect@nytimes.com R=1Qo1nO-0004D9-0s P=INPUT S=1010
    2011:08:01-19:21:20 gateway smtpd[16193]: SCANNER[16193]: id="1001" severity="info" sys="SecureMail" sub="smtp" name="email quarantined" srcip="216.146.33.79" from="nytdirect@nytimes.com" to="web@cowley.us" subject="News Alert: House Passes Debt Ceiling Bill" queueid="1Qo1nU-0004DB-Bn" size="1010" reason="as" extra=""
    2011:08:01-19:21:20 gateway smtpd[16193]: SCANNER[16193]: 1Qo1nO-0004D9-0s => work R=SCANNER T=SCANNER
    2011:08:01-19:21:20 gateway smtpd[16193]: SCANNER[16193]: 1Qo1nO-0004D9-0s Completed
    2011:08:01-19:21:50 gateway smtpd[16193]: SCANNER[16193]: Nothing to do, exiting.

    Thanks in advance for any thoughts,
    Martin.
  • 0
    Martin, I don't know if Astaro would call that a "bug" or not, but it looks like an "undocumented feature" to me...

    Definitely worth an Astaro Support ticket!

    Cheers - Bob
     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0
    Thanks Bob - not sure I can raise one as a home user, as I don't have a high enough support level.  Still, maybe someone at Astaro will spot this thread on the BB and chime in.  In the meantime, I'll probably add a few exceptions to allow the bulk mail I do want to receive to avoid quarantine.

    Cheers,
    Martin.
  • 0
    Yeah getting a few more here too, even one's from Apple getting the quarantine treatment.
  • 0
    Yes, we updated the AntiSpam engine (a licensed third-party software) in 8.200. We did this to improve the spam detection rate, because we got several complaints about the ASG not detecting all spam.

    The problem is, that you can't effectively workaround undetected spam by adding spammy words to the expression list. But you can very effectively workaround falsely detected spam from known senders (like in your case) by adding the sender to the user's white list.

    Regards,
    mlenk
  • 0
    @mlenk:  Is the engine still provided by Commtouch or is it from a completely different vendor?  Thanks.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
  • 0
    We're still using Commtouch's ctasd. In ASG 8.200 we updated it from version 3.01.0017 to 4.02.0014.
  • 0
    Thanks for the info.
    __________________
    ACE v8/SCA v9.3

    ...still have a v5 install disk in a box somewhere.

    http://xkcd.com
    http://www.tedgoff.com/mb
    http://www.projectcartoon.com/cartoon/1
Cookie Information Banner