https://foss.jose-marcio.org/wiki/ 2026-04-24T03:05:12+00:00 https://foss.jose-marcio.org/wiki/ https://foss.jose-marcio.org/wiki/lib/exe/fetch.php/wiki/dokuwiki.svg text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/bad_sender_mx?rev=1518191959&do=diff Checking sender MX Introduction This check consists in checking MXs (name and IP address) of the domain part of the envelope sender address against a blacklist. Usually you can reject messages if the domain part of the sender address can't receive mail (you can't answer him). text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/bayesian_filtering?rev=1518191959&do=diff Bayesian Filtering with ze-filter What's bayesian filtering and ze-filter's implementation Statistical (Bayesian) filtering is being used by many mail filters. Although first research results about using bayesian filters to filter spam were first presented in 1998 by Sahami, Heckerman, Dumais and Horwitz, they were implemented after Paul Graham posted a page about, four years later, it in his blog : text/html 2017-12-01T11:00:14+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/content_filter_actions?rev=1512126014&do=diff Defining actions and headers After checking message contents, the filter assigns a global score to the message. ze-filter can take different actions depending on the global score assigned to the message or to scores assigned by each kind of check. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/dnsbl?rev=1518191959&do=diff dnsbl.ze-filter.org dnsbl.ze-filter.org Rejecting messages from residential addresses dnsbl.ze-filter.org is a “poor's man reputation list” which can be used with ze-filter, as explained here. Entries in this list are best described as end-users, or home users: customers who are not supposed to send out emails directly, and even if they do, they are not supposed to send large amount of emails. List consists of IP addresses or hostnames matching some regular pattern which indicates that they're … text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/grey_server?rev=1518191959&do=diff Greylisting - centralized versus distributed databases When filtering messages for some domain is done in multiple MXs, there are two basic ways to manage databases for greylisting : having a single database accessed by all MXs or having a copy of triplets database distributed over all nodes. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/greylisting?rev=1518191959&do=diff Greylisting Introduction ze-filter implements greylisting method from Evan Harris. ze-filter implementation is intended to be used on huge servers. So, it tries to reduce the number of entries on database, and uses results from other filtering methods to remove unwanted entries. Other than original databases (pending and validated entries), ze-filter uses two new databases : whitelisted entries and blacklisted entries. Whitelisted entries database contains only couples of IP and domain names. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/heuristic_filter?rev=1518191959&do=diff Heuristic filter ORACLE Introduction “The Merriam-Webster Dictionary” oracle : one held to give divinely inspired answers or revelations ze-filter's oracle is a set of tests about weak spam indicators. Some examples are : * the messages contains a text/html part, but not a text/plain part. text/html 2017-12-01T10:57:55+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/medium_term_rate?rev=1512125875&do=diff Medium term rate and resources limiting While Short term rate control takes actions based on values gathered on a short time period (10 minutes) and for all sources, Medium term rate control is intended to take actions based on unwanted or suspect behaviour over a much longer time period (~ 4 hours). text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/miscelaneous?rev=1518191959&do=diff "Simple Spam Checks..." These checks don't block a significant number of spams. They exist or as they we're requested by some user or because they can solve some specific problem. E.g. rejecting short messages or dropping Notification Delivery Requests are intended to solve a privacy issue. So, don't enable them unless you need them. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/pattern_matching?rev=1518191959&do=diff Pattern Matching Configuring ze-filter Configure it : SPAM_REGEX YES REGEX_FILE ze-regex REGEX_MAX_SCORE 50 SPAM_REGEX_MAX_MSG_SIZE 40000 SPAM_REGEX_MAX_MIME_SIZE 15000 DUMP_FOUND_REGEX YES REGEX_LOG_FILE file:ze-regex text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/rbwl?rev=1518191959&do=diff Reputation - Realtime DNS based White/Black Lists (RWL/RBL) ze-filter can make use of two kind of data distributed on DNS servers : * Black/White list of IP addresses and hostnames - these lists may be used to dynamically define classes of SMTP clients based on the presence of these hosts inside text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/recipient_access?rev=1518191959&do=diff Recipient Validation / Recipient Access Recipient Validation is absolutely necessary in mail gateways. Some reasons are : * Mail servers shall not accept messages sent to invalid recipients, to avoid backscattering. * You may want to protect some valid email addresses from outside of your domain. E.g. you can define a valid address - everybody@example.com - and allow it receive only messages coming from inside your organisation. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/short_term_rate?rev=1518191959&do=diff Short term rate and resources limiting In November 1975, Jon Postel issued the historic RFC 706 On the Junk Mail Problem. His goal was clearly to warn people about the possibility of Denial of Service generated by Junk Mail. Many people refers to this RFC as being one of the first publications about spam. But this text/html 2018-02-09T16:04:06+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/sidebar?rev=1518192246&do=diff Spam Filtering * Behaviour filtering * Short Term Rate Limit * Medium Term Rate Limit * Greylisting * Greylisting server * Greylisting Performance * Content filtering * Pattern Matching * URL filtering * Heuristic filter (Oracle) * Bayesian Filtering * Defining actions * Using ze-filter headers * Other filtering methods * Reputation - RWL/RBL * dnsbl.ze-filter.org * Recipient Access * Bad Sender MX * Miscelaneous... Up text/html 2018-02-09T16:04:17+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/start?rev=1518192257&do=diff Spam Filtering with ze-filter Behaviour filtering * Short term behaviour (rate limits) * Medium term behaviour (rate limits) * Greylisting * Greylisting server Content filtering * Pattern Matching (REGEX) * URLBL filtering * Heuristic filter (Oracle) * Bayesian Filtering - a statistical filter. * Defining actions - what to do with that score... * MUA filtering - how end users can explore headers added by ze-filter. text/html 2018-02-09T15:59:19+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/url_filtering?rev=1518191959&do=diff URL filtering Introduction URLBL filtering extracts all URLs from the body of the message and checks the domain part against a blacklist. Although it's possible to create your own blacklist of URLs, it's hard to maintain it. A good idea is to use text/html 2017-12-01T11:00:14+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/using_headers?rev=1512126014&do=diff Using ze-filter headers (filtering on MUA) Introduction When ze-filter checks the content of a message it can add two kind of headers : X-ze-filter-Score and X-ze-filter-Status. These headers can be used, by the final recipient, to create a filter on the MUA (Thunderbird, text/html 2018-02-09T16:03:53+00:00 Anonymous (anonymous@undisclosed.example.com) https://foss.jose-marcio.org/wiki/doku.php/doc/spam/ze-greyd?rev=1518192233&do=diff ze-greyd - Greylist database server Introduction ze-filter has two configuration options which control how they handle greylisting. The configuration option GREY_MODE can take value STANDALONE or CLIENT. In standalone mode the filter manages all greylisting data, while in