Question regarding SPAM
Hi, I have a question about SPAM being sent via Mailman.
- Even though the message is marked as SPAM it is still sent to the list
- The sender is not a member of the moderated list
- Spam filters at the other members site are catching the Spam and returning the not delivered message (example below)
- Have I mis-configured something in the Mailman to allow this to happen (It happens often)
Thank you, Rose
Example Message:
This is the mail delivery agent at messagelabs.com. I was not able to deliver your message to the following addresses.
Remote host said: 554 5.7.9 Message not accepted for policy reasons.
--- Below this line is a copy of the message.
Return-Path: <mailman-bounces@list.informs.org> X-Env-Sender: mailman-bounces@list.informs.org X-Msg-Ref: server-8.tower-85.messagelabs.com!1348767090!55220986!1 X-Originating-IP: [216.230.111.83] X-StarScan-Received: X-StarScan-Version: 6.6.1.3; banners=-,-,- X-VirusChecked: Checked Received: (qmail 16887 invoked from network); 27 Sep 2012 17:31:30 -0000 Received: from mail.informs.com (HELO mail.informs.org) (216.230.111.83) by server-8.tower-85.messagelabs.com with SMTP; 27 Sep 2012 17:31:30 -0000 Received: by mail.informs.org (Postfix, from userid 506) id 7354A20798; Thu, 27 Sep 2012 13:31:30 -0400 (EDT) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on informs-app02-listserv.custcbb.local X-Spam-Flag: YES X-Spam-Level: ******************* X-Spam-Status: Yes, score=19.2 required=5.0 tests=BAYES_99,DATE_IN_PAST_03_06,
Received: from informs-app02-listserv.custcbb.local (localhost [127.0.0.1]) by mail.informs.org (Postfix) with ESMTP id DE0E42086E; Thu, 27 Sep 2012 13:31:29 -0400 (EDT)
Date: Thu, 27 Sep 2012 06:31:17 -0600 From: Cierra Orozco via LinkedIn <member@linkedin.com> Reply-To: Cierra Orozco <JacksonYore@mnp.ca> To: southeastern-michigan-chapter-owner <southeastern-michigan-chapter-owner@list.informs.org> Message-ID: <126881171.1872436.8821718263356.JavaMail.app@ela0-app0430.prod> Subject: [SPAM] United Postal Service Tracking Number H8260315491 MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_Part_2502201_6486519708.0424312323509"
Futchko, Rose wrote:
Hi, I have a question about SPAM being sent via Mailman.
- Even though the message is marked as SPAM it is still sent to the list
Marked by what?
You could use the list's Privacy options... -> Spam filters -> header_filter_rules to hold or discard such messages. It is not a good idea to reject them as the sender is likely spoofed so the rejection is just backscatter.
- The sender is not a member of the moderated list
Then how did the post reach the list? What is the list's Privacy options... -> Sender filters -> generic_nonmember_action setting?
[...]
- Have I mis-configured something in the Mailman to allow this to happen (It happens often)
See 2. above?
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Sapiro, Mark wrote:
Marked by what?
In the message sent by Mailman, the Subject line contained [SPAM] from our spam manager, i.e. = Subject: [SPAM] United Postal Service Tracking Number H8260315491
You could use the list's Privacy options... -> Spam filters -> header_filter_rules to hold or discard such messages. It is not a good idea to reject them as the sender is likely spoofed so the rejection is just backscatter.
I will configure this as mentioned.
Then how did the post reach the list? What is the list's Privacy options... -> Sender filters -> generic_nonmember_action setting?
Discard
Futchko, Rose wrote:
Sapiro, Mark wrote:
Then how did the post reach the list? What is the list's Privacy options... -> Sender filters -> generic_nonmember_action setting?
Discard
Then again, how did the post reach the list in the first place. Non-member posts are discarded and you said the list is moderated which I think means that member posts are held for moderation, so how does a spam post get to the list?
Does the list have some unmoderated members? If so, if a post contains one of these member addresses in any of a From:, Reply-To: or Sender: header or as the envelope sender, the post may be accepted (see the documentation for SENDER_HEADERS in Defaults.py).
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
Sapiro, Mark wrote:
Then again, how did the post reach the list in the first place.
Non-member posts are discarded and you said the list is moderated which I think means that member posts are held for moderation, so how does a spam post get to the list?
Does the list have some unmoderated members? If so, if a post contains one of these member addresses in any of a From:, Reply-To: or Sender: header or as the envelope sender, the post may be accepted (see the documentation for SENDER_HEADERS in Defaults.py).
Not that I am aware of that setting or subscriber (over 2000) for that particular list. I saw email messages sent in the POSTFIX maillog to the individual from the spamfilter (spamassasin) that was installed to work with Postfix. Trying to work backwards, I have removed Spamassassin from Postfix and restarted. While not sure and do not have any proof, I wanted to eliminate this as a potential cause.
One question: is there a report or command that I can run to see how many members where unsubscribed from any list on our Mailman service for a period of time. My reason is if this individual was unsubscribed, I am not sure how many other subscribers may have been lost. Therefore, I would like to reinstate all subscribers lost over the past two week period.
Thank you, Rose
On 9/30/2012 8:03 PM, Futchko, Rose wrote:
One question: is there a report or command that I can run to see how many members where unsubscribed from any list on our Mailman service for a period of time.
The information is in Mailman's bounce and subscribe logs.
-- Mark Sapiro <mark@msapiro.net> The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan
participants (2)
-
Futchko, Rose -
Mark Sapiro