Spam:*****, Increased spam in proxy mode

Hi Guys!



Since we moved Surgemail to proxy mode we've been receiving
more SPAM in 
our mailboxes.
After checking the logs on front-end and back-end server
I've noticed 
that there are a lot of spam points that get lost on the
back-end.
The spam settings on both Front-ends and back-ends are the
same.
This is an example for the same message:

Front-end:
17.700001 Marked by FiveTen=1.0, Marked by AbuseEat=5.0, 
From5consonants=1.0, DodgySource=2.0, SPF Default Fail=2.5,

X-Verify-Failed present=2.0, combo mx and smtp and from=2.0,

X-Verify-SMTP present=0.6, X-Verify-MX present=1.6"

Back-end:
9.600000 Marked by FiveTen=1.0, Marked by AbuseEat=5.0, 
From5consonants=1.0, X-Verify-Failed present=2.0,
X-Verify-SMTP present=0.6"


Why is this happening, here?
Is there something that can be done to have the spam being
blocked again?



Thanks in advance,


Nelio Vieira
==========================

IT Management
Cabo Tv Madeirense S.A.
Phone: + 351 291 601 295
Fax: + 351 291 766132
www.datacentermadeira.com
www.netmadeira.com
==========================

Try adding this to the backend.
	G_SPAM_HEADER_TRUST_IP  
"ip.address.of.front.end"

We will update the docs to make this recommended for this
configuration.

Let me know if it doesn't work as desired.

	ChrisP.


Nelio Vieira wrote:
> Hi Guys!
> 
> 
> 
> Since we moved Surgemail to proxy mode we've been
receiving more SPAM in 
> our mailboxes.
> After checking the logs on front-end and back-end
server I've noticed 
> that there are a lot of spam points that get lost on
the back-end.
> The spam settings on both Front-ends and back-ends are
the same.
> This is an example for the same message:
> 
> Front-end:
> 17.700001 Marked by FiveTen=1.0, Marked by
AbuseEat=5.0, 
> From5consonants=1.0, DodgySource=2.0, SPF Default
Fail=2.5, 
> X-Verify-Failed present=2.0, combo mx and smtp and
from=2.0, 
> X-Verify-SMTP present=0.6, X-Verify-MX
present=1.6"
> 
> Back-end:
> 9.600000 Marked by FiveTen=1.0, Marked by AbuseEat=5.0,

> From5consonants=1.0, X-Verify-Failed present=2.0,
X-Verify-SMTP 
> present=0.6"
> 
> 
> Why is this happening, here?
> Is there something that can be done to have the spam
being blocked again?
> 
> 
> 
> Thanks in advance,
> 
> 
> Nelio Vieira
> ==========================
> 
> IT Management
> Cabo Tv Madeirense S.A.
> Phone: + 351 291 601 295
> Fax: + 351 291 766132
> www.datacentermadeira.com
> www.netmadeira.com
> ==========================
> 
> 
> 
> 

Hi Chris,


Sorry but, although it's wise to use that configuration, it
didn't got 
better.
Here's another example:

FrontEnd:
17 14:12:24[36375765] Aspam 118.173.51.141 <jramstadstate.nd.us> 
<zpmmnetmadeira.com> 4790
<741e01c85913$85fe37e0$c009c85eTaylor> 
"notrust ******************************: 42.709000 More
with an 
exclamation=0.4, Marked by FiveTen=1.0, Marked by PSBL=3.5,
Marked by 
AbuseEat=5.0, Share Market Scam=2.0, million &
DodgySrc=1.0, 
DodgySource=2.0, SPF Default Fail=2.5, X-Verify-Failed
present=2.0, 
Sender's IP was on Spamcop RBL=5.0, S_ab=1.1, S_ob=1.1,
S_sc=1.1, 
S_jp=1.1, SURBL=4.0, Subject has many exclamations=0.7, Spam
tool patter"

BackEnd:
17 14:11:20[4857645] Aspam 213.190.193.39 <jramstadstate.nd.us> 
<zpmmnetmadeira.com> 5127
<741e01c85913$85fe37e0$c009c85eTaylor> 
"notrust ******************************: 31.609001 More
with an 
exclamation=0.4, Marked by FiveTen=1.0, Marked by PSBL=3.5,
Marked by 
AbuseEat=5.0, X-Verify-Failed present=2.0, Sender's IP was
on Spamcop 
RBL=5.0, S_ab=1.

What else can be done?


Thanks,


Nelio Vieira



Support ChrisP wrote:
> Try adding this to the backend.
>     G_SPAM_HEADER_TRUST_IP  
"ip.address.of.front.end"
>
> We will update the docs to make this recommended for
this configuration.
>
> Let me know if it doesn't work as desired.
>
>     ChrisP.
>
>
> Nelio Vieira wrote:
>> Hi Guys!
>>
>>
>>
>> Since we moved Surgemail to proxy mode we've been
receiving more SPAM 
>> in our mailboxes.
>> After checking the logs on front-end and back-end
server I've noticed 
>> that there are a lot of spam points that get lost
on the back-end.
>> The spam settings on both Front-ends and back-ends
are the same.
>> This is an example for the same message:
>>
>> Front-end:
>> 17.700001 Marked by FiveTen=1.0, Marked by
AbuseEat=5.0, 
>> From5consonants=1.0, DodgySource=2.0, SPF Default
Fail=2.5, 
>> X-Verify-Failed present=2.0, combo mx and smtp and
from=2.0, 
>> X-Verify-SMTP present=0.6, X-Verify-MX
present=1.6"
>>
>> Back-end:
>> 9.600000 Marked by FiveTen=1.0, Marked by
AbuseEat=5.0, 
>> From5consonants=1.0, X-Verify-Failed present=2.0,
X-Verify-SMTP 
>> present=0.6"
>>
>>
>> Why is this happening, here?
>> Is there something that can be done to have the
spam being blocked 
>> again?
>>
>>
>>
>> Thanks in advance,
>>
>>
>> Nelio Vieira
>> ==========================
>>
>> IT Management
>> Cabo Tv Madeirense S.A.
>> Phone: + 351 291 601 295
>> Fax: + 351 291 766132
>> www.datacentermadeira.com
>> www.netmadeira.com
>> ==========================
>>
>>
>>
>>
>
>