Spamassassin or firewall

[GravuTrad]

Hi

Since some updates, spamassassin is clearly not doing its work.

Domains putted in blacklist in plesk panel can still send mails (so are received via qmail by the server while spamassassin must block them).

So the spam is free now with plesk 11.5.30 last updates done...

Why?

Thanks

 

[GravuTrad]

No news? It currently clearly doesn't work well....

 

[IgorG]

Any related details from maillog?
"It doesn't work" is really not enough, sorry.

 

[GravuTrad]

One of my examples:

For a domain (mailmetrash.com) putted in blacklist in server mail and in spamassassin (*@mailmetrash.com), i receive again its mails. (inscriptions)

here is the log:

Oct 28 06:17:02 ksxxxxx qmail: 1382937422.887608 end msg 10561113
Oct 28 06:17:02 ksxxxxx spamd[22601]: prefork: child states: II 
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: Handlers Filter before-queue for qmail started ...
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: from=anonymous@ksxxxxx.kimsufi.com
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: to=carmafrisina6534@mailmetrash.com
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: handlers_stderr: SKIP
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: SKIP during call 'check-quota' handler
Oct 28 06:18:07 ksxxxxx spf filter[4562]: Starting spf filter... 
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: handlers_stderr: SKIP
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: SKIP during call 'spf' handler
Oct 28 06:18:07 ksxxxxx qmail-queue-handlers[4559]: starter: submitter[4563] exited normally
Oct 28 06:18:07 ksxxxxx qmail: 1382937487.664677 new msg 10561113
Oct 28 06:18:07 ksxxxxx qmail: 1382937487.664802 info msg 10561113: bytes 1317 from <anonymous@ksxxxxx.kimsufi.com> qp 4563 uid 48
Oct 28 06:18:07 ksxxxxx qmail: 1382937487.764604 starting delivery 70: msg 10561113 to remote carmafrisina6534@mailmetrash.com
Oct 28 06:18:07 ksxxxxx qmail: 1382937487.764711 status: local 0/1 remote 1/1
Oct 28 06:18:07 ksxxxxx qmail-remote-handlers[4565]: Handlers Filter before-remote for qmail started ...
Oct 28 06:18:07 ksxxxxx qmail-remote-handlers[4565]: from=anonymous@ksxxxxx.kimsufi.com
Oct 28 06:18:07 ksxxxxx qmail-remote-handlers[4565]: to=carmafrisina6534@mailmetrash.com
Oct 28 06:18:09 ksxxxxx qmail: 1382937489.070457 delivery 70: failure: 75.126.133.30_does_not_like_recipient./Remote_host_said:_550_Requested_action_not_taken:_mailbox_unavailable_or_not_local/Giving_up_on_75.126.133.30./
Oct 28 06:18:09 ksxxxxx qmail: 1382937489.070876 status: local 0/1 remote 0/1
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: Handlers Filter before-queue for qmail started ...
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: from=
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: to=anonymous@ksxxxxx.kimsufi.com
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: Unable to get sender domain by sender mailname
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: Unable to get sender domain by sender mailname
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: handlers_stderr: SKIP
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: SKIP during call 'check-quota' handler
Oct 28 06:18:09 ksxxxxx spf filter[4568]: Starting spf filter... 
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: handlers_stderr: SKIP
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: SKIP during call 'spf' handler
Oct 28 06:18:09 ksxxxxx qmail-queue-handlers[4566]: starter: submitter[4569] exited normally
Oct 28 06:18:09 ksxxxxx qmail: 1382937489.224491 bounce msg 10561113 qp 4566
Oct 28 06:18:09 ksxxxxx qmail: 1382937489.224724 end msg 10561113

 

[GravuTrad]

Blacklisting is clearly not working well. What's the problem?

 

[IgorG]

Try to rebuild mail handlers and mail settings with following procedure:

# plesk sbin mchk --with-spam

 

[GravuTrad]

Nothing changed. The same ips arrive to pass their mails...and same domains too (like mailnesia.com).
How to ban a range of ips?

nb: how to change the "anonymous@ksxxxxx.kimsufi.com" address produced by qmail? all the qmail files concerned contains well my pesk admin mail, but always this like server email sender name...

 

[GravuTrad]

example:

spambog.com is putted in blacklist on the server mail parameters (spambog.com) and antispam (*@spambog.com), and i receive again mails from them: author: ronaldwhipple@spambog.com

etc....

Blacklists have clearly problems on plesk panel....