来自ASSP Extreme Ban的极度头痛

我的服务器上有一个本地用户，截至今天，他们无法从任何设备发送电子邮件。只有Webmail（不接触任何设备）可以工作。

以下是我在日志中收到的各种电子邮件故障。

Dec-04-12 19:52:47 75966-05166 [SpoofedSender] 111.111.111.111 <[email protected]> to: [email protected] [scoring:20] -- No Spoofing Allowed -- [Test]; Dec-04-12 19:52:47 75966-05166 [Extreme] 111.111.111.111 <[email protected]> to: [email protected] [spam found] -- score for 111.111.111.111 is 1980, surpassing extreme level of 500 -- [Test] -> spam/Test__1.eml; Dec-04-12 19:52:48 75968-05169 111.111.111.111 <[email protected]> to: [email protected] [scoring:10] -- IP in HELO does not match connection: '[192.168.0.10]' -- [Re Demo Feedbacks for End of November Sales]; Dec-04-12 19:52:48 75968-05169 [SpoofedSender] 111.111.111.111 <[email protected]> to: [email protected] [scoring:20] -- No Spoofing Allowed -- [Re Demo Feedbacks for End of November Sales]; Dec-04-12 19:52:48 75968-05169 [Extreme] 111.111.111.111 <[email protected]> to: [email protected] [spam found] -- score for 111.111.111.111 is 2020, surpassing extreme level of 500 -- [Re Demo Feedbacks for End of November Sales] ->spam/Re_Demo_Feedbacks_for_End_of_N__2.eml; Dec-04-12 19:52:57 75977-05179 [SpoofedSender] 111.111.111.111 <[email protected]> to: [email protected] [scoring:20] -- No Spoofing Allowed -- [test]; Dec-04-12 19:52:57 75977-05179 [Extreme] 111.111.111.111 <[email protected]> to: [email protected] [spam found] -- score for 111.111.111.111 is 2040, surpassing extreme level of 500 -- [test] -> spam/test__3.eml; ……………. Dec-04-12 19:55:35 76135-05338 [SpoofedSender] 111.111.111.111 <[email protected]> to: [email protected] [scoring:20] -- No Spoofing Allowed -- [test]; Dec-04-12 19:55:35 76135-05338 [MsgID] 111.111.111.111 <[email protected]> to: [email protected] [scoring] (Message-ID not valid: 'E8472A91545B44FBAE413F6D8760C7C3@bts'); Dec-04-12 19:55:35 76135-05338 [InvalidHELO] 111.111.111.111 <[email protected]> to: [email protected] [spam found] -- Invalid HELO: 'bts' -- [test] -> discarded/test__4.eml;

注意：111.111.111.111是用户家庭IP地址的replace

这是其中一条消息的标题

 X-Assp-Score: 10 (HELO contains IP: '[192.168.0.10]') X-Assp-Score: 10 (IP in HELO does not match connection: '[192.168.0.10]') X-Assp-Score: 20 (No Spoofing Allowed) X-Assp-Score: 10 (bombSubjectRe: 'sale') X-Assp-Score: 20 (blacklisted HELO '[192.168.0.10]') X-Assp-Score: 45 (DNSBLcache: failed, 111.111.111.111 listed in safe.dnsbl.sorbs.net) X-Assp-DNSBLcache: failed, 174.0.35.31 listed in safe.dnsbl.sorbs.net X-Assp-Received-SPF: fail (cache) ip=174.0.35.31 [email protected] helo=[192.168.0.10] X-Assp-Score: 10 (SPF fail) X-Assp-Envelope-From: [email protected] X-Assp-Intended-For: [email protected] X-Assp-Version: 1.7.5.7(1.0.07) on ASSP.nospam X-Assp-ID: ASSP.nospam (77953-07232) X-Assp-Spam: YES X-Assp-Original-Subject: Re: Demo Feedbacks for End of November Sales X-Spam-Status:yes X-Assp-Spam-Reason: MessageScore (125) over limit (50) X-Assp-Message-Totalscore: 125 Received: from [192.168.0.10] ([111.111.111.111] helo=[192.168.0.10]) with IPv4:25 by ASSP.nospam; 4 Dec 2012 20:25:52 -0700 Content-Type: multipart/alternative; boundary=Apple-Mail-40FE7453-4BE7-4AD6-B297-FB81DAA554EC Content-Transfer-Encoding: 7bit Subject: Re: Demo Feedbacks for End of November Sales References: <003c01cdd22e$eafbc6f0$c0f354d0$@com> From: Some User <[email protected]> In-Reply-To: <003c01cdd22e$eafbc6f0$c0f354d0$@com> Message-Id: <[email protected]> Date: Tue, 4 Dec 2012 19:32:28 -0700 To: External User <[email protected]> Mime-Version: 1.0 (1.0) X-Mailer: iPhone Mail (10A523)

为什么我们的本地服务器上禁止本地发件人，我该如何解决？

只是我，还是头没有告诉你为什么这个用户被拒绝的邮件？

X-Assp-Spam-Reason：MessageScore（125）超出限制（50）

他的信息太垃圾邮件。具体的原因也在头文件中进一步列出…

 X-Assp-Score: 10 (HELO contains IP: '[192.168.0.10]') X-Assp-Score: 10 (IP in HELO does not match connection: '[192.168.0.10]') X-Assp-Score: 20 (No Spoofing Allowed) X-Assp-Score: 10 (bombSubjectRe: 'sale') X-Assp-Score: 20 (blacklisted HELO '[192.168.0.10]') X-Assp-Score: 45 (DNSBLcache: failed, 111.111.111.111 listed in safe.dnsbl.sorbs.net) X-Assp-DNSBLcache: failed, 174.0.35.31 listed in safe.dnsbl.sorbs.net X-Assp-Received-SPF: fail (cache) ip=174.0.35.31 [email protected] helo=[192.168.0.10] X-Assp-Score: 10 (SPF fail)

包含IP的HELO +10，IP不匹配连接IP +10，无欺骗+20，主题词sale +10，黑名单HELO +20（再次使用该IP），+ 45的IP位于黑名单（safe.dnsbl.sorbs.net），+ 10的SPF失败。最多可添加125个，大于您的垃圾邮件阈值50。

对我来说似乎很清楚。我错过了什么？

编辑：

针对你的评论，

我看到两个问题，第一个是你的外部IP位于SORBS-DUHL黑名单上，虽然它给了我一个奇怪的返回码，似乎是唯一的黑名单…所以我会联系他们礼貌地问问到底是怎么回事。这是125个垃圾邮件分数中的45个。

第二个问题似乎是你的ASSP被configuration为将任何来自私有IP（192.168.0.10）的垃圾邮件都评分为垃圾邮件，而且当你的用户在家的时候（根据你的评论），他可能在一些SOHO路由器或交换机分配他的个人电脑私人IP（192.168.0.10）。这是125个垃圾邮件分数中的至less40个，可能是60或70个 – 我不能确定为什么SPF失败和欺骗失败发生，但是我怀疑他们都与这个用户正在尝试从您的域名发送邮件，但使用对您公司networking邮件无效的IP地址。

无论哪种方式，唯一的解决scheme，我可以看到要么整理用户的家庭networking，以便他的个人电脑在ISP提供的外部IP地址看到自己，或更改您的垃圾邮件filter的规则，以适应这个用户。我build议的选项不涉及必须支持一些用户的家庭networking。或者，也可以考虑告诉用户，他的家庭设置与您的邮件设置不兼容，他必须自己处理，自行修复或使用networking邮件。实际上，这就是我所要做的，因为它的工作量较less，而且我通常不希望为一个用户更改整个垃圾邮件过滤scheme。

因此，一个正常情况下得分为10的邮件（包含在该主题中的sale ），由于任何一个问题都在阈值以上得分。所以看起来您必须解决我们在这里看到的黑名单和IP问题，才能使邮件可靠地从本地发件人stream动。