Spamhaus DQS key integration

[durglewankelshteim]

I know this was discussed in a previous post, however, is this true?

"Alternative HestiaCP Method
If using a newer version of HestiaCP, you can use the built-in command to add the DQS key without manually editing templates, as the system automatically prevents key leakage:
v-add-sys-mail-dnsbl yourkey.zen.dq.spamhaus.net"

I am going to try it, but how to verify it? Does it simply update the required exim4 files?

Well. Tests reveal:

Queries lead to spamassassin config. Which yields same results…interesting.

[sahsanu]

@durglewankelshteim

is this true?

Yes, it is.

@durglewankelshteim

as the system automatically prevents key leakage

That’s true if your installation is relatively new, you should check your current exim conf:

grep spamhaus /etc/exim4/exim4.conf.template

If above command doesn’t show any output, you must edit /etc/exim4/exim4.conf.template and replace this:

deny    message       = Rejected because $sender_host_address is in a black list at $dnslist_domain\n$dnslist_text

with this:

deny    message       = Rejected because $sender_host_address is in a black list at ${if match{$dnslist_domain}{^[^.]+[.](.+dq[.]spamhaus.*)}{$1}{$dnslist_domain}}\n$dnslist_text

@durglewankelshteim

v-add-sys-mail-dnsbl yourkey.zen.dq.spamhaus.net"

If you add the dns block list with your key, remember to remove zen.spamhaus.org:

v-delete-sys-mail-dnsbl zen.spamhaus.org
v-add-sys-mail-dnsbl yourkey.zen.dq.spamhaus.net

[durglewankelshteim]

@sahsanu

v-delete-sys-mail-dnsbl zen.spamhaus.org

ok that checks out, however, it still receives the dbl-dqs-ehlo and so forth so it seems incomplete. Spamhaus has always scared me so I am inclined just to remove it altogether as it is obvious they do not care enough to provide a decent solution unless any can comment otherwise?

[sahsanu]

@durglewankelshteim

dbl-dqs-ehlo

To block those tests you must also add rules to spamassassin.

Configure Spamhaus DBL and ZRD

Hi @Felix, You must add support for Spamhaus DQS to SpamAssassin. Here is the repo with the instructions, but I have also included just the needed steps below: Note: replace abcdefghijklmnop0123456789 with your actual DQS Key. cd /usr/local/src/ git clone https://github.com/spamhaus/spamassassin-dqs cd spamassassin-dqs/4.0.0+/ sed -i -e 's/your_DQS_key/abcdefghijklmnop0123456789/g' sh.cf cp sh.cf /etc/spamassassin/ cp sh_scores.cf /etc/spamassassin/ To check that there are no errors: spamas…

[durglewankelshteim]

Oh, I see, for anyone doing this interested I had to check the reject spam in the edit mail domain THEN do v-add-mail-domain-antivirus user domain from the command line to have this work.

[sahsanu]

@sahsanu

That’s true if your installation is relatively new, you should check your current exim conf:

grep spamhaus /etc/exim4/exim4.conf.template

I’ve created this PR to fix existing Exim installations:

Fix the “Rejected because” DNSBL message for existing Exim installations (#5683)

[durglewankelshteim]

It was working for a day, then stopped:

I tried even reinstalling and to no avail.

[sahsanu]

Did you follow again the steps in my post? I’ve also modified in exim4.conf.template SPAM_REJECT_SCORE = 100 to SPAM_REJECT_SCORE = 80

But to know what’s the score Spamassassin is adding to the mail, check the mail that passed and look the headers (there you should see the Spamassassin report)

[durglewankelshteim]

Yes I did. Next I will set it up again on a fresh instance.

[durglewankelshteim]

Tested it on a new install and it is good:

Is there a way to “clean”/reinstall exim4 and spamassassin from the hestiacp repos?

[durglewankelshteim]

Went back to the other instance, completely removed spamassassin, reinstalled, reconfigured it, same thing:

If this makes sense to anyone and there is anything to check please advise. Thanks.

[sahsanu]

Double check that the mail domain has enabled “reject spam”.

Show the output of this command:

grep -E '^SPAM' /etc/exim4/exim4.conf.template

Also, to understand what’s going on, it’s important to check the headers of those delivered emails. There, you can see the SpamAssassin report and check the scores assigned to each message.

[durglewankelshteim]

@sahsanu

grep -E '^SPAM' /etc/exim4/exim4.conf.template

grep -E ‘^SPAM’ /etc/exim4/exim4.conf.template
SPAMASSASSIN = yes
SPAM_SCORE = 50
SPAM_REJECT_SCORE = 80

I prepped a brand new server, migrated the sites to it and it is behaving fine, I have NO clue as to what went wrong on that old server or why a spamassassin complete reinstall making sure no files were left behind doesn’t set it the same, I even tried copying the exact files from the new working server…so one or two more days just remove that server and forget it.

[sahsanu]

As you are not showing the spam report of the mail being delivered to your server, add this to SpammAssassin:

cat > /etc/spamassassin/disable-dnswl.cf <<'EOF'
dns_query_restriction deny list.dnswl.org
score RCVD_IN_DNSWL_NONE 0
score RCVD_IN_DNSWL_LOW 0
score RCVD_IN_DNSWL_MED 0
score RCVD_IN_DNSWL_HI 0
EOF

cat > /etc/spamassassin/disable-mailspike.cf <<'EOF'
dns_query_restriction deny bl.mailspike.net
dns_query_restriction deny wl.mailspike.net
EOF

cat > /etc/spamassassin/disable-validity.cf <<'EOF'
dns_query_restriction deny sa-trusted.bondedsender.org
dns_query_restriction deny sa-accredit.habeas.com
dns_query_restriction deny bl.score.senderscore.com
EOF

Once done restart SpamAssassin and try again:

systemctl restart spamd

[durglewankelshteim]

I appreciate it, however, none of these are in the working versions I have running so I am simply going to remove that instance and move on. I have two instances running with the fresh install and tested on spamhaus so pretty confident I can reproduce that any time. Having good backups is a luxury.