SMTP Blocking - Not Working

Problem reported by Paul R - 3/14/2018 at 6:34 AM

Submitted

We've found that for our own purposes, sending IPs listed on SpamCop and Spamhaus are almost guaranteed spam. We gave RBL "hits" on SpamCop and all 4 Spamhaus RBLs a weight of 31. They are also enabled for SMTP blocking. SMTP blocking threshold is set at 31, which means a hit on ANY of these RBLs should be an automatic reject during the SMTP session, which is why we don't also have them enabled for queue filtering-- because the message should never even reach the queue. Ever.

Yet, tons of spams are getting through from IP addresses that are absolutely listed in Spamhaus and/or SpamCop.

Any ideas why?

4 Replies

Reply to Thread

Paul R Replied

3/14/2018 at 7:18 AM

I may have found the problem. Regarding the threshold, the SM documentation is shown in the screenshot below. It appears "score of this value or higher" is not accurate. Only the "higher" part is.

When I dropped the blocking threshold to 30, rejections based on RBLs started working.

SMARTERTOOLS: it appears you need to either fix the program bug, or amend your documentation, because "this value" is not enough to trigger the block rule. It has to be "higher" than the value set.

Paul R Replied

3/15/2018 at 6:22 AM

Update: SMTP blocking by RBL is only working minimally. Ton of messages getting through, from MXes whose IPs are all over the RBLs mentioned above-- all of which have an individual weight (31) that is higher than the SMTP blocking threshold (30).

Several IPs I spot-checked from the logs appear on multiple RBLs, and their score should have collectively been 93 or higher. (way above 30). And yet miraculously, they are getting through with no problem.

Also, yesterday shortly after my first post, I enabled the above RBLs (in my screenshot) for spool filtering also, not just SMTP blocking. So from a visible config standpoint, I can't see ANY valid reason why any of these emails were allowed through.

Any ideas?

Joe Wolf Replied

3/15/2018 at 6:25 AM

What version is this? I know mine works fine on latest v15.x. If on v16.x my observation is that many things work on one release but not the other. Very strange.

-Joe

Paul R Replied

3/15/2018 at 10:11 AM

SM 16, brand new system just installed a few weeks ago.

We've been using SM continually since version 3 more than a decade ago, and this is the first time I've not been able to get SMTP blocking working reliably based on RBL listings.

It sort-of works because I'm seeing a FEW log entries with:
"554 Sending address not accepted due to spam filter"

But a LOT are getting through that should clearly not. I've manually looked up IP addresses of spam that got through, and most are listed on multiple RBLs and their score should soar above 90... but somehow they get past a "30" threshold setting.

Back to Community Threads

Please leave this box unchecked

4 Replies

Reply to Thread

Tags

Related Knowledge Base Articles