Re: [9fans] need help with improving my spam filtering

[Heiko Dudzus <heiko.dudzus@gmx.de>]

> This worked for a while, but now I am getting
> more and more spam getting through (mostly because of the anti-bayes
> mechanism of hiding the spam in a picture and sending it together with
> random but apparently OK text).

Same here.  I made a hold rule for this in /mail/lib/patterns, allowing
only some people and lists to send GIFs. Works for the moment but
could be too restrictive.

> So, I'd like to expand my spam stopping capabilities.  I have read
> smtpd(6), ratfs(4), and scanmail(8) but find myself slightly at sea on
> how to combine these to allow me to filter out some of the more
> obvious spam.
> If I understand correctly, I can start ratfs(4) and since it'll read
> the default /mail/lib/blocked file my smtpd(6) will then block some
> emails.  

Based on the connecting IP address and originating account, yes.

> I can also replace qer(8) with scanmail(8) in my
> /mail/lib/qmail and therefore block out even more emails.

Based on the content of the mail.  Because you said, it's just for
your own little maildrop, be aware that incoming mail can only be
filtered with scanmail(8) when it gets resent (and queued) to your own
system with the little trick discussed in this thread:

http://9fans.net/archive/2002/03/257

> PS I guess an alternative approach would be for me to use fresh email
>    addresses for mailing lists every so often.  But that feels
>    shortsighted somehow.

Greylisting is another option.  (When I saw in the source, that
greylist.c can deal with entire whitelisted subnets, it was an option
for me again)

Heiko