Mail server is to strict with filtering? And virus mails get through sometimes!

[Terran]

The spammers have developed a new technique which almost always bypasses most spam filters:
All spam filters which are based on some kind of statistical analysis (e.g. bayes or razor) depend on statistical analyzable data. They assume that most spam has common attributes e.g. words like "viagra" or whatever the spam wants to advertise. And they assume some other criterias like a minimum percentage of HTML code.
What the spammers do to bypass the filters is very simple but effective:
- avoid those keywords
- use 1337 language for keywords !!!!
- add some random text to the mail to make each mail unique

@spamassassin:
Don't use Subject: rewriting, instead use the X-Spam headers. Your Subject: lines won't get altered and almost every mail client can filter for custom header lines.

@general suggestion:
Use IMAP instead of POP3.
With IMAP you can have your mail folders at the server and also filter the mails at the server into different folders. Users with slow connections benefit from another feature too: the e-mail clients doesn't need to download the entire messages, instead he only downloads some parts of the header to get an overview of the mails. And only if the user opens a message it's downloaded. And even then attachements are only downloaded at request.

[Onno Kreuzinger]

we have imap here, i think i saw it open in the firewall. also the wiki uses imap for the staff authentication; and the server is started in the inetd

so i encourage all BU email users to switch to imap mail clients.

[Pierre-Marie Baty]

Back on Cheeseh's suggestion.

This is VERY MUCH doable.

Currently, what no mail scanner can do, is scanning the message in its POST-PROCESSED form. Meaning, when all the tags have been cleaned out, when "Vìàgrà" has been translated into "Viagra", when the 2-pixel high random text has been stripped, when the white text that no one can see on the white background has been stripped too. It's all about cleaning the spam. THEN, it would be very easy to filter that out.

[Nova]

Originally Posted by Pierre-Marie Baty

Back on Cheeseh's suggestion.

This is VERY MUCH doable.

Currently, what no mail scanner can do, is scanning the message in its POST-PROCESSED form. Meaning, when all the tags have been cleaned out, when "Vìàgrà" has been translated into "Viagra", when the 2-pixel high random text has been stripped, when the white text that no one can see on the white background has been stripped too. It's all about cleaning the spam. THEN, it would be very easy to filter that out.

OMG. THIS MailServer is a serious mess. Ok, volunteers please:

I really need someone that

1) Has extensive sendmail knowledge, and can install / configure sendmail for all the domains / users on this server properly (coz the config is a mess and all over the place, especially the userpermission of the spooler files ...

2) Configure the IMAP. What i really would like to do. Have two specific IMAP folders. One that low-scoring spam gets written into (between 5 and 10 spamassasin score) and one for highscoring (above 10)

3) Someone that knows MailScanner better than I do (because most of the time is just take a good guess and hope it works ...

4) Someone that knows how to PROPERLY configure spamassassin so that its integrated in MailScanner properly.

If ANYONE is up for the challenge, please post here or email me or whatever.

Regards,
Sebastian

[Cheeseh]

Well back to what I was saying, I was meangin making an end-user application, that simply downloads stuff from the server and can go into two categories, spam & not spam. And the program can learn from these e-mails to figure out what is spam and isn't, and of course it might think non-spam stuff is spam, so move it into spam stuff and make it learn etc.etc... some sorta big dynamic NN might work lol :O and things that identify each e-mail either by splitting it up into words from a dictionary or taking crc's and md5sums. urk

[Terran]

Finally I got some time again to participate at BU :-)

@Nova:
@sendmail:
sendmail is one of the worst pieces of code ever written. Dump it. It has a never ending story of serious bugs and this will never end because of it's poor design.
@IMAP:
You don't need to configure this, usually the user creates the folders.
@Mailscanner:
I don't know about this tool.
@spamassassin:
Add it to the individual users .forward file...

@Cheeseh:
Those applications already exist. E.g. current versions of mozilla/thunderbird or opera have this feature.

[Cheeseh]

:o cool never knew :p