Question Can you help me set up to prevent spam?

[Manuel Cornejo]

Hello,

I wanted to ask for help to see if I can solve a problem.

First, I apologize for my English

We are receiving a lot of spam; The spam mails almost always follow the same pattern, but change the subject, message body, recipients and domain from which "supposedly" sent.

In the server runs with: Centos 7 Plesk 12.5 and Postfix.
I activated the antispam protection based on SPF, at the server level.

But spam still slipping through more than taste different options SPF spam protection.

Eyeing the meeting postfix log:

Oct 27 12:41:03 mail2 postfix/smtpd[3996]: 026DA3E801A7: client=unknown[166.78.237.208]
Oct 27 12:41:03 mail2 postfix/cleanup[31263]: 026DA3E801A7: message-id=<25b7f1725f9acf3806520a5d3d3ac879@iidany.org>
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: handlers_stderr: SKIP
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: SKIP during call 'limit-out' handler
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: handlers_stderr: SKIP
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: SKIP during call 'check-quota' handler
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Starting spf filter...
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Error code: (2) Could not find a valid SPF record
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Failed to query MAIL-FROM: No DNS data for 'iidany.org'.
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF result: pass
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF status: PASS
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: handlers_stderr: PASS
Oct 27 12:41:03 mail2 /usr/lib64/plesk-9.0/psa-pc-remote[21434]: PASS during call 'spf' handler
Oct 27 12:41:03 mail2 postfix/qmgr[30184]: 026DA3E801A7: from=<fonda_marcos@iidany.org>, size=1494, nrcpt=1 (queue active)
Oct 27 12:41:03 mail2 postfix-local[4449]: postfix-local: from=fonda_marcos@iidany.org, to=mcornejo@applinet.es, dirname=/var/qmail/mailnames
Oct 27 12:41:03 mail2 spamd[25270]: spamd: connection from mail2.applinet.es [::1]:34758 to port 783, fd 6
Oct 27 12:41:03 mail2 spamd[25270]: spamd: using default config for mcornejo@applinet.es: /var/qmail/mailnames/applinet.es/mcornejo/.spamassassin/user_prefs
Oct 27 12:41:03 mail2 spamd[25270]: spamd: processing message <25b7f1725f9acf3806520a5d3d3ac879@iidany.org> for mcornejo@applinet.es:30
Oct 27 12:41:03 mail2 postfix/smtpd[3996]: disconnect from unknown[166.78.237.208]
Oct 27 12:41:03 mail2 spamd[25270]: spamd: clean message (-1.1/2.0) for mcornejo@applinet.es:30 in 0.1 seconds, 1732 bytes.
Oct 27 12:41:03 mail2 spamd[25270]: spamd: result: . -1 - BAYES_00,HTML_MESSAGE,RDNS_NONE scantime=0.1,size=1732,user=mcornejo@applinet.es,uid=30,required_score=2.0,rhost=mail2.applinet.es,raddr=::1,rport=34758,mid=<25b7f1725f9acf3806520a5d3d3ac879@iidany.org>,bayes=0.000000,autolearn=no autolearn_force=no
Oct 27 12:41:03 mail2 spamd[25267]: prefork: child states: II
Oct 27 12:41:03 mail2 dovecot: service=lda, user=mcornejo@applinet.es, ip=[]. msgid=<25b7f1725f9acf3806520a5d3d3ac879@iidany.org>: saved mail to INBOX
Oct 27 12:41:03 mail2 postfix/pipe[2352]: 026DA3E801A7: to=<mcornejo@applinet.es>, relay=plesk_virtual, delay=1.5, delays=1.2/0/0/0.26, dsn=2.0.0, status=sent (delivered via plesk_virtual service)
Oct 27 12:41:03 mail2 postfix/qmgr[30184]: 026DA3E801A7: removed

Highlight the lines:

Oct 27 12:41:03 mail2 journal: spf filter[4448]: Starting spf filter...
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Error code: (2) Could not find a valid SPF record
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Failed to query MAIL-FROM: No DNS data for 'iidany.org'.
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF result: pass
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF status: PASS

A screenshot of the config (sorry for being in Spanish):

some help?

Thank you,

Regards,

Manuel.

 

[IgorG]

The notifications Error code: (2) Could not find a valid SPF record and Failed to query MAIL-FROM: No DNS data for 'domain.tld' occur if the domain domain.tld does not have a valid SPF record in the DNS. In this case, SPF local rules are not applied.

The message is processed according to SPF checking mode set in server-wide mail preferences Home > Mail Server Settings > Switch on SPF spam protection > SPF checking mode.

To resolve the problem, you should configure SPF records in the DNS zone of the domain that sends mail (MAIL FROM).

Oct 27 12:41:03 mail2 journal: spf filter[4448]: Error code: (2) Could not find a valid SPF record Oct 27 12:41:03 mail2 journal: spf filter[4448]: Failed to query MAIL-FROM: No DNS data for 'iidany.org'.

This issue can be resolved by following the instructions posted in this KB article - https://kb.plesk.com/en/126414

 

[Manuel Cornejo]

IgorG, thank you very much for your answer.

Yes, I had seen and applied this case.

Currently, my setup is as indicated by the post that you reference me.
(Except for setting "SPF record for the sender domain").

For some reason: it may be that the configuration can not be palicando correctly?

I failed to detect that I can be doing wrong.

Thank you very much.

Regards,

Manuel.

 

[Manuel Cornejo]

Hello Again,

Igor, can I ask you a question?

How do I configure plesk to reject emails that do not have configured SPF records?

I refer to this case:

Oct 27 12:41:03 mail2 journal: spf filter[4448]: Starting spf filter...
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Error code: (2) Could not find a valid SPF record
Oct 27 12:41:03 mail2 journal: spf filter[4448]: Failed to query MAIL-FROM: No DNS data for 'iidany.org'.
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF result: pass
Oct 27 12:41:03 mail2 journal: spf filter[4448]: SPF status: PASS

(I would like the server to reject this type of emails)

Thanks and Sorry for the incoveniences.

Regards,

 

[IgorG]

How do I configure plesk to reject emails that do not have configured SPF records?