Dspam trials discussion thread

the only real issue we saw with dspam is loopback errors that were causing some email to be bounced back. We are working to fix that.
We had very few complaints of false positives, which you can view if you decide to quaratine your email.

You can choose to not use the new dspam system by adding a custom MX record. I will post instructions for this when we put mail5 live again

Ticked Customer… see below error message. Did you by chance post instructions on the custom mx? I can’t seem to find it. This whole DSPAM thing is too problematic and the client wants it off so I need to make sure I have instructions on turning it off. They will use local SPAM system that they believe to be more reliable. Thanks

  1. Your membership in the mailing list women_dev has been disabled due to excessive bounces The last bounce received from you was dated 02-Feb-2007. You will not get any more messages from this list until you re-enable your membership. You will receive 3 more reminders like this before your membership in the list is deleted.
  1. This is the mail system at host dspam1.local.

I’m sorry to have to inform you that your message could not be delivered to one or more recipients. It’s attached below.

For further assistance, please send mail to

If you do so, please include this problem report. You can delete your own text from the attached returned message.

               The mail system
<[email protected]>: mail for mydomain.com loops back to myself

By the way… her mail server is mail6.

can you ask her if she has seen any more bounces since 00:40 AM EST today.

The thing is she doesn’t see the bounce… it is the person emailing her that sees it so they don’t always let her know… some I guess just ignore it and move on.

I’ll check to see if anyone has said anything else, but I currently have the MX record not using DSPAM.

I won’t change this back until a bit longer to make sure no one else here is experiencing the bounce back.

Thanks

I had to turn DSPAM off also on all my domains, I wasn’t get support tickets from my clients and imporatant E-mails were getting bounced.

I will wait as well till the bugs are worked out. I almost lost a client because I didn’t know I had a support ticket till almost 2 hours later becasue I never got a notification, luckly they called.

We believe we fixed the bounce issue as tanmaya mentioned

Has DSPAM been re-enabled on mail5?

techfuzz

um, yes, I think DSPAM has been re enabled becasue a bunch of my emails are getting bounced again!!!

---------- Forwarded message ----------
From: Mail Delivery System < [email protected]>
Date: Feb 6, 2007 10:34 AM
Subject: Undelivered Mail Returned to Sender
To: [email protected]

This is the mail system at host dspam1.local.

I’m sorry to have to inform you that your message could not
be delivered to one or more recipients. It’s attached below.

For further assistance, please send mail to

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

               The mail system 

<[email protected]>: host 64.187.103.252[H-SPHERE] said: 558 sorry, that
message size exceeds my databytes limit (#5.3.4) (in reply to MAIL FROM
command)

Final-Recipient: rfc822; [email protected]
Original-Recipient: rfc822;tim@Trusted Technical Solutions :: Home
Action: failed
Status: 5.0.0
Remote-MTA: dns; H-SPHERE
Diagnostic-Code: smtp; 558 sorry, that message size exceeds my databytes limit
(#5.3.4)

yes, mail5 is again using the dspam gateway now. I’ve disabled the check completely that can cause this bounce and monitoring for next 5 hours.
Please let me know if you see any more bounces.

I’ve avoided this for a while until it settles down and have only recently activated for my own account to test. These are my own observations and suggestions, some directly DSPAM related and others not:
[ol]
[li]I find the information in the header of the DSPAM flag insufficient. Why did DSPAM flag it?
[/li][li]While I’ve seen no noticeable difference in the number of SPAM messages that fail to be flagged, I have seen an increase in false positives. In the one instance the same message I received twice on two different email addresses, the one was marked as SPAM the other not???
[/li][li]Of those that were are not flagged it takes me 10 seconds to identify and delete 90% of them without even opening them and just by eye-balling the nonsenseness of the subjects and sender email addresses and/or names - is it that hard for a computer to do the same?
[/li][li]I can white list all the sender email addresses but I can’t expect my clients to do this. I’m also not 100% convinced it works properly as one of the false positives was already in my white list. Does it make a difference if the from and reply-to are slightly different? It was listed as *@domain.com and I’ve changed it to *.domain.com - maybe that makes a difference.
[/li][li]A global white list across all our clients would be useful. For example, I’ve noticed email from our tax authorities (no comment) are being flagged as SPAM - to add this to every white list is a burden.
[/li][li]With emails marked as SPAM (but aren’t) I sometimes can’t read the original email. Is this an email client problem? I’m using Thunderbird and IMAP.
[/li][li]I make use of a catch-all email account - it would be useful to be able to ‘black-list’ ‘to’ addresses. What I currently do is set up an account for the invalid email address with a ‘delete all’ setting. But that’s really messy.
[/li][/ol]

I appreciate all that’s been done to combat this sickness and trust that there will be positive improvements.

I submitted a trouble ticket on Feb 21st and a dozen emails later I’m still no closer to getting this same issue resolved. Before I had opened the trouble ticket, I had entered some email addresses in my domain’s whitelist. Those whitelist entries were only being recognized about 1/2 the time. I could get 2 emails in a row from the same email address that was whitelisted, both would be marked as SPAM by DSPAM, but one would be marked as SPAM by Spam Assassin while the next one was not.

So far, technical support has added and removed then re-added and re-removed so many different combinations of whitelist addresses I’ve lost count. Nothing they have tried so far has worked.

techfuzz

We understand the white-listing mechanism has had some issues. I’ll see what Tanmaya says…

comp-du-it, I’m surprised you’ve seen no reduction in the amount of spam email. I’ve seen my spam cut by 90%.

There are false positives, and we are working to improve accuracy. But really, no system is 100% perfect and the false positive rate I’m seeing in the case of my email is in line with most commercial filtering systems. However, depending on your nature of email, that could be different

Which whitelist/blacklist are you talking about? The ones configurable as always from H-Sphere?

Also, what does it mean to have spam cut off? What strategy do you use? I believe you can flag messages a SPAM but there’s always the possibility of false positives, so you still need to review all the mails flagged as SPAM too.

I know with Spam Assassin the White-list doesn’t really work if you use catch-all. If you use catch-all, you have to add the “to” addresses as an alias/forward to your catch-all address for the white-list to work. This may be the case for DSpam as well.

Hopefull that makes sense, if not let me know and I’ll try to explain better.

Hell no :slight_smile:
If someone wants to send me a ‘legitimate’ mail and happen to start it with with “viagra rolex make make money fast” and send it from a RBL listed server, tough luck for them.. Sure, I get false positives. But none of them have a (spamassassin) spam score over 7 or so. Anything over 8 I outright delete or I would go insane.

Where do you see the score? Are you talking about some client software or something at the server?

Thank you very much.

Client software - look at the email headers of email received.

If I have to see headers of each mail marked as spam it’s worse than simply review them. I was wondering about what SubSpace told. Do you still have to review the messages to delete them or is there a way to say anything with a high spam score just trash it automatically?

What strategy do others use?