Surgemail Spam Control

||include||style.htm|| ||ifdef||g_newui_advanced|| ||define||url_info||&doframes=false&displaymode=advanced|| ||else|| ||define||url_info||&doframes=false|| ||endif|| ||include||body.htm||

||ifdef||message||

||message||

||endif||

Spam Control

||ifequal||displaymode||advanced|| Switch to: ||else|| Switch to: ||endif||

To effectively combat spam a combination of techniques needs to be used. Currently the most effective combination of techniques uses SPF + SURBL + ASpam and needs to be periodically reviewed to confirm it is working in your environment. A complete discussion of techniques available can be found in the online help.

||include||table.htm|| ||g_spam_allow_desc|| ||ifequal||displaymode||advanced|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif||

Default user settings :

Define default Friends, Spam and SPF settings for users. Users can override these with personal settings.

||include||table.htm|| Settings for all domains: ||include||domain_select.htm||

||ifequal||displaymode||advanced|| ||endif||

Primary detection techniques

SPF settings :

SPF provides the best method of sender verification available and should typically stop all spam with spoofed addresses (typically upto 80% of spam). For for an overview and technical details see http://netwinsite.com/spf.htm.
WARNING: Using an external "virus wall" SMTP scanner in front of surgemail is a very bad idea

||include||table.htm||

||g_spf_mode_desc||

||g_spf_rewrite_desc||

||g_spf_rev_skip_desc||

||g_spam_grey_dflt_bad_desc||

||g_spam_grey_dflt_desc||

||lang_get(g_spam_body_more_desc)||

||lang_get(g_spam_flag_desc)||

||lang_get(g_spam_grey_desc)||

||lang_get(g_spam_grey_bounce_desc)||

||lang_get(g_spam_grey_classc_desc)||

||lang_get(g_spam_grey_nofive_desc)||

||lang_get(g_spam_grey_nseen_desc)||

||lang_get(g_spam_grey_size_desc)||

||lang_get(g_spam_grey_verify_desc)||

||lang_get(g_spam_grey_window_desc)||

||lang_get(g_spf_baddns_skip_desc)||

||lang_get(g_spf_byweb_desc)||

||lang_get(g_spf_debug_log_desc)||

||lang_get(g_spf_default_desc)||

||lang_get(g_spf_default_noblock_desc)||

||lang_get(g_spf_dns_timeout_desc)||

||lang_get(g_spf_domain_desc)||

||lang_get(g_spf_enforce_local_desc)||

||lang_get(g_spf_header_desc)||

||lang_get(g_spf_noallow_desc)||

||lang_get(g_spf_nocache_desc)||

||lang_get(g_spf_nogrey_desc)||

||lang_get(g_spf_norewrite_desc)||

||lang_get(g_spf_rewrite_relay_desc)||

||lang_get(g_spf_share_desc)||

||lang_get(g_spf_skip_desc)||

||lang_get(g_spf_skip_from_desc)||

||lang_get(g_spf_skip_to_desc)||

||lang_get(g_spf_very_strict_desc)||

||lang_get(g_spflog_domains_desc)||

||lang_get(g_spflog_enable_desc)||

||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 31 $$additional settings in$$ advanced mode) ||endif||

ASpam settings :

ASpam is surgemail's content based message scoring mechanism that allows users to set their own tolerance to spam. ASpam adds a XSpamDetect header to each message which can be used for filtering by the mail client or server-side filtering using surgemail webmail or user.cgi interfaces. The SpamDetect score may also be modified using custom techniques. For more information and technical details see online help.

||include||table.htm|| Enable ASpam (g_spam_internal) ||g_spam_userconfig_desc|| ||g_spam_catcher_desc|| ||ifequal||displaymode||advanced|| ||g_spam_subject_desc|| ||g_spam_subject_word_desc|| ||g_smite_gateway_desc|| ||g_smite_all_desc|| ||g_spam_autotrain_desc|| ||g_spam_notspam_desc|| ||g_spam_notrain_desc|| ||g_spam_private_desc|| ||endif|| Skip smitecrc scanner for messages from these domains ||ifequal||displaymode||advanced|| ||g_smite_skip_ip_desc|| ||g_smite_skip_auth_desc|| ||g_smite_skip_to_desc|| Should probably not be used: ||g_spam_bounce_desc|| ||g_spam_bounce_all_desc|| ||g_spam_aspam_desc|| ||g_spam_poly_desc|| ||g_spam_url_desc|| ||g_smite_level_desc|| Other settings: ||lang_get(g_aspam_headers_desc)|| ||lang_get(g_aspam_need_ip_desc)|| ||lang_get(g_smite_skip_relay_desc)|| ||lang_get(g_smite_tag_desc)|| ||lang_get(g_spam_body_desc)|| ||lang_get(g_spam_body_url_desc)|| ||lang_get(g_spam_bounce_text_desc)|| ||lang_get(g_spam_bounce_trusted_desc)|| ||lang_get(g_spam_char_desc)|| ||lang_get(g_spam_check_auth_desc)|| ||lang_get(g_spam_content_disable_desc)|| ||lang_get(g_spam_header_trust_ip_desc)|| ||lang_get(g_spam_hold_keep_desc)|| ||lang_get(g_spam_info_desc)|| ||lang_get(g_spam_info_hide_desc)|| ||lang_get(g_spam_isspam_kind_desc)|| ||lang_get(g_spam_noupdate_desc)|| ||lang_get(g_spam_poly_disable_desc)|| ||lang_get(g_spam_share_desc)|| ||lang_get(g_spam_subject_dom_desc)|| ||lang_get(g_spam_subject_gateway_desc)|| ||lang_get(g_spam_vanish_desc)|| ||lang_get(g_spam_vanish_all_desc)|| ||lang_get(g_spamdetect_always_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 41 $$additional settings in$$ advanced mode) ||endif||

SURBL settings :

SURBL interfaces to a realtime database of URLs that spammers use. This is very effective against spam messages that only contain a URL and thus are hard to score based on content. This will add a X-Surbl header and add to the SpamDetect score used by ASpam.

||include||table.htm|| ||g_surbl_desc|| ||ifequal||displaymode||advanced|| ||lang_get(g_surbl_skip_desc)|| ||lang_get(g_surbl_skip_ip_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 2 $$additional settings in$$ advanced mode) ||endif||

RBL settings :

RBL lists can be used to outright block listed systems, or modify the SpamDetect score as used by ASpam. The recommended mode is stamp.

||include||table.htm|| ||g_orbs_list_desc|| ||ifequal||displaymode||advanced|| ||g_orbs_late_desc|| ||g_orbs_check_all_desc|| ||g_orbs_force_desc|| ||g_orbs_cache_life_desc|| ||endif|| ||g_orbs_exception_desc|| ||ifequal||displaymode||advanced|| ||lang_get(g_orbs_report_desc)|| ||lang_get(g_orbs_service_desc)|| ||lang_get(g_orbs_system_desc)|| ||lang_get(g_orbs_testing_desc)|| ||lang_get(g_orbs_timeout_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 9 $$additional settings in$$ advanced mode) ||endif||

||ifequal||displaymode||advanced|| ||endif||

Additional techniques

Friends Challenge Response :

The Friends system must be enabled by individual users can be used used in several ways. The most useful is to send a Friends message to email that has received a medium spam rating.

||include||table.htm||

||g_friends_only_desc||

||g_friends_ignore_desc||

||lang_get(g_friends_always_desc)||

||lang_get(g_friends_at_rcpt_desc)||

||lang_get(g_friends_byweb_desc)||

||lang_get(g_friends_check_spf_desc)||

||lang_get(g_friends_confirm_debug_desc)||

||lang_get(g_friends_confirm_subject_desc)||

||lang_get(g_friends_latest_headers_desc)||

||lang_get(g_friends_name_desc)||

||lang_get(g_friends_pending_keep_desc)||

||lang_get(g_friends_pending_vanish_desc)||

||lang_get(g_friends_silent_desc)||

||lang_get(g_friends_skip_ip_desc)||

||lang_get(g_friends_spf_fail_bounce_desc)||

||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 13 $$additional settings in$$ advanced mode) ||endif||

Automatic Allow mechanism :

If mail is blocked by SPF, SURBL, or rbl the allow mechanism will allow the sending users to send a special message to add themselves to the list of IP addresses that surgemail accepts mail from.

||include||table.htm|| ||g_spam_block_desc|| ||ifequal||displaymode||advanced|| ||g_spam_block_msg_desc|| ||g_spam_allow_msg_desc|| ||g_spam_allow_known_desc|| ||g_spam_allow_rbl_desc|| ||lang_get(g_spam_allow_disable_desc)|| ||lang_get(g_spam_allow_recent_desc)|| ||lang_get(g_spam_block_gateway_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 7 $$additional settings in$$ advanced mode) ||endif||

Manually blocking :

Mail can be blocked based on many message / sender parameters. This can be used but tends to be most effective as an interim measure as it results in an unmaintainable solution that is easily bypassed by serious spammers.

||include||table.htm|| Deny users from IP's Deny users from IP's for smtp only ||ifequal||displaymode||advanced|| ||lang_get(g_deny_msg_desc)|| ||endif|| Ban based on from envelope Ban based on rcpt address Spam filter rules ||ifequal||displaymode||advanced|| ||lang_get(g_ban_blackhole_desc)|| ||lang_get(g_ban_helo_desc)|| ||lang_get(g_cid_skip_to_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 4 $$additional settings in$$ advanced mode) ||endif||

Limits :

Limits to avoid system abuse by spammers and due to misconfiguration. If a limit is hit the message is outright refused with an appropriate bounce error, or in some cases sender is either 'tarpitted' (surgemail starts talking real slow, or lying in its responses to discourage spammers).
Note: Also a distinction is made in some cases on limits applied to trusted users (connected using SMTP authentication) and limits applied to non trusted users.

||include||table.htm|| ||g_msg_max_desc|| IP address limits: ||g_con_perip_desc|| ||ifequal||displaymode||advanced|| ||g_con_persubnet_desc|| ||g_con_perip_except_desc|| ||endif|| Tarpiting limits: ||g_bomb_max_desc|| ||ifequal||displaymode||advanced|| Max bad addresses in a row (dictionary attack) ||endif|| ||g_tarpit_max_desc|| ||ifequal||displaymode||advanced|| ||g_bomb_max_from_desc|| ||g_max_bad_nolookup_desc|| ||g_spam_user_max_desc|| ||g_tarpit_badrcpt_desc|| ||g_tarpit_blackhole_desc|| ||g_tarpit_drop_desc|| ||g_tarpit_max_remote_desc|| Other limits: ||lang_get(g_smtp_max_desc)|| ||lang_get(g_smtp_maxbad_desc)|| ||lang_get(g_spam_user_skip_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 13 $$additional settings in$$ advanced mode) ||endif||

Alternative sender verification :

SPF is the recommended sender verification technique to use. However surgemail does have the alternative techniques as specified in this section.

||include||table.htm|| DomainKeys: ||lang_get(g_domainkeys_check_desc)|| $$Create DomainKeys for signing outgoing messages$$ ||lang_get(g_domainkeys_sign_desc)|| ||ifequal||displaymode||advanced|| ||lang_get(g_domainkeys_only_desc)|| ||lang_get(g_domainkeys_selector_desc)|| Bad from checks, unreliable and superceeded by SPF: ||g_badfrom_check_desc|| ||g_badfrom_stamp_desc|| ||g_badfrom_badmx_desc|| Whitelist to skip from checks ||g_badfrom_noip_desc|| ||g_badfrom_from_desc|| ||g_from_timeout_desc|| Sender MX record verification, again unreliable and superceeded by SPF: Verify sender is in MX record ||g_verify_mx_skip_desc|| Superceeded by SPF: Require reverse DNS names match ||g_dns_paranoid_desc|| ||lang_get(g_domainkeys_headers_desc)|| ||lang_get(g_lookup_names_desc)|| ||lang_get(g_verify_helo_desc)|| ||lang_get(g_verify_smtp_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else||
||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 17 $$additional settings in$$ advanced mode) ||endif||

Obscure settings :

(all advanced).

||include||table.htm|| ||ifequal||displaymode||advanced|| Other settings: ||lang_get(g_black_above_desc)|| ||lang_get(g_black_count_desc)|| ||lang_get(g_black_to_desc)|| ||lang_get(g_dns_match_msg_desc)|| ||lang_get(g_dns_noptr_desc)|| ||lang_get(g_dns_noptr_msg_desc)|| ||lang_get(g_dns_noptr_skip_desc)|| ||lang_get(g_notag_url_forgery_desc)|| ||lang_get(g_url_enable_desc)|| ||lang_get(g_user_filter_early_desc)|| ||lang_get(g_vanish_any_bounce_desc)|| ||lang_get(g_smtp_max_nolimit_desc)|| ||lang_get(g_smtp_max_reason_desc)|| ||lang_get(g_from_allow_desc)|| ||lang_get(g_from_allow_ip_desc)|| ||lang_get(g_from_bl_desc)|| ||lang_get(g_from_bounce_desc)|| ||lang_get(g_from_check_desc)|| ||lang_get(g_from_exact_desc)|| ||lang_get(g_from_relay_desc)|| ||lang_get(g_from_relay_white_desc)|| ||lang_get(g_from_stamp_desc)|| ||lang_get(g_lookup_reject_fails_desc)|| ||lang_get(g_vanish_bad_bounces_desc)|| ||lang_get(g_vanish_virus_bounces_desc)|| ||endif|| ||ifequal||displaymode||advanced||
||else|| ||endif|| ||ifdef||settings_saved||settings saved||endif|| ||ifequal||displaymode||advanced|| (switch back to standard mode) ||else|| ( 25 $$additional settings in$$ advanced mode) ||endif||

||ifequal||displaymode||advanced|| Hint: Setting background colour indicates whether it is a standard or advanced mode setting. Also settings in italics have been automatically added to the relevant sections of this web admin user interface. These are likely to be new or obscure.

||endif||