Autoresponder problems wtih SPAM

[waterman34]

Hey all

Got a question regarding auto-responders and spam. The way that we deal with spam for our clients is if the sender is listed on 3 or more blacklists, we mark the subject as spam and leave it through like any normal email to allow the client to deal with it as they see fit, this works great but if they enable an autoresponder, it starts to build up a large backlog of mail on the outgoing queue that cant be delivered because the spam user doesn't exist so for the time being we have disabled the autoresponder until we can maybe find a workaround.

If a particular user on our system though sets any emails with spam in the subject to be automatically deleted by AMS rather than delivered, would this then stop the autoresponder replying to the spam emails?

I'm hoping that it doesn't get as far as the autoresponder before it gets deleted?

[m1byo]

I dont know how this would suit your needs, but you could you set up a content filtering rule which:
* looks for the SPAM token in the subject of an outgoing mail and if it finds it you could delete the email.
* Checks that recipients are not local so that it is only outgoing emails get deleted.

I hope this helps

Ian

[waterman34]

Interesting idea, I wonder what tech support have to say on this?

[waterman34]

Hi Ian

Well support haven't posted back about this but I'll try giving it a go anyway but I'm not able to see how to set the rule up for this properly, can you give me some pointers if you know how to do it by any chance?

I suppose it can't be too difficult but I've only ever used the preset rules

[rob]

If the user sets the filters to delete any SPAM in there own personal filter settings, this will delete mail before the autoreponse is triggered. However, a simple solution to prevent autoresponses from triggering and filling your queue would be to modify the SMTP sender address, which autoresponses rely on. To do this create a rule which detects your SPAM mails (probably by the SPAM flag condition) and then add an action "Rename Sender". At moment it isn't possible to blank this string, but you can enter a local email address which is intended solely to accept these extra autoresponses.

[waterman34]

Hi Rob

Thanks for the info, <edit> would this be correct as per ians idea above?

Conditions
1. SMTP sender matches "<SPAM>" (case sensitive)

Actions
1. Delete email

[rob]

Ians idea is also a good method and to implement this you would need a rule which does the following...

Conditions:
#1: Sender / Recipient Exists - Set to "All Recipients" and "Do Not Exist Locally".
#2: AND Header Line Matches - Using the Subject and set to "Contains" match mode and a string of "<SPAM>".
#3: AND SMTP Sender Matches - Set to "Does Not Contain" match mode and a string of "@".

Actions:
#1: Delete Mail

This would of course only work if you have another content filer rule which inserts "<SPAM>" into the subject (there is a preset rule which does this), and of course users who always include the subject of the original mail. The third condition is intended to distinguish between normal outgoing mail (which is a reply) and auto-response type mail (which is a notification without any sender). I should note this also hasn't been tested so perhaps rather than delete mail, perhaps send it to another account using redirection, that way you can monitor what is being deleted to start with.

[waterman34]

Great cheers Rob, I've enabled this on our server which sends a copy to another email address rather than delete for the time being so will let you know how it goes

[waterman34]

Hi guys

Okay I've almost got this nailed but there's a bit of a twist in the original requirements on this one if you have the patience to bear with me on this one! but it will probably help others out as well.

I've noticed there's also mail in the queue that is addressed to domains that use our server as backup mx, but mail is being refused by some sort of filter on their primary mail server because they have been marked as spam, so rather than accepting them, they're leaving them in our queue to expire and it would be a nightmare to continually have to monitor that as it could change on a daily basis, so I have the following content filter applied at the moment which deals with this problem and so far works okay (or seems to

Conditions:
1. Sender does not exist locally
2.AND all recipients do not exist locally
3.AND "subject" header line contains "<SPAM>"

Actions:
1.Delete email.


BUT what can I add to this rule to prevent the original autoresponder problem?

[rob]

The simpliest method would be to have both rule setup and enabled at the same time. This way you can tweak one without the danger of breaking the other. However, the rule you have setup appears to be ok, but again I would test it out with a redirection for a period.

[Marc]

I dont know how this would suit your needs, but you could you set up a content filtering rule which:
* looks for the SPAM token in the subject of an outgoing mail

How do you set up a rule that only applies to outgoing mail?

[Code Crafters]

This is already explained on page 1 of this topic by rob. You can filter a content filter rule to apply to outgoing mail only as follows:

Conditions:
#1: Sender / Recipient Exists - Set to "All Recipients" and "Do Not Exist Locally".

I'd recommend you go back and read rob's replies to this, and if possible read all replies in the topic to make sure any questions you have aren't already answered in previous posts to this topic.

[Marc]

I saw that but didn't understand what it meant, but I have checked the settings again and understand it now...

I have setup a redirect and I'll see how it goes.

I assume a redirect to another email address on the same server, although a different domain, wouldn't get relayed out, but would be moved locally on the server.

[Code Crafters]

Yes, redirections to local accounts will be delivered locally and wouldn't be relayed unless the account didn't exist.