Alerts for SPAM

bpsintl

Is there any way that we can set up an alert if one of the users on our mailcow server starts sending spam? We are migrating users over from our previous provider and we have 100s of email accounts and need some way of getting an alert so we can disable users quickly if they try to send bulk emails or spam etc.

We need to protect our IP sending reputation.

CK_beats

You could define a message limit of emails to be sent per minute/hour.
Is set in Email -> Configuration -> Mailbox -> Templates (if desired globally).

RspamD also checks all outgoing messages. If the machine learning is trained accordingly, you could also filter outgoing SPAM.

bpsintl

Yeah I’ve seen the message limits, currently set that to 500/day. Do you think that’s too many?

How do I train RspamD and set it to filter outgoing emails?

CK_beats

bpsintl
500 messages a day would be far too many for our business use. But it depends on your customer base.
For a normal/private environment or a small club, I would set a maximum of 100 emails per day.
If it’s not enough for one of your customers, you can explicitly activate their mailbox for more messages.

RspamD learns independently via Bayesian and machine learning.
You can later increase the Bayesian SPAM weight and reduce the MAILCOW_AUTH weight. You have to “play” and try something to find a good middle ground.

You can access the RspamD console at yourmailhost.tld/rspamd/ with your admin credentials.

bpsintl

Excellent, thanks for that. I shall lower that (I only copied what the current email system has that we are migrating away from).

@[deleted] I’ve just logged into the RspamD console and can see the configuration tab. How exactly do I look at/change the SPAM weight you mentioned, and how do you set it to block outgoing SPAM?

I’ve just logged into the RspamD console and can see the configuration tab. How exactly do I look at/change the SPAM weight you mentioned, and how do you set it to block outgoing SPAM?

[unknown] I’ve just logged into the RspamD console and can see the configuration tab. How exactly do I look at/change the SPAM weight you mentioned, and how do you set it to block outgoing SPAM?

bpsintl

I’ve just logged into the RspamD console and can see the configuration tab. How exactly do I look at/change the SPAM weight you mentioned, and how do you set it to block outgoing SPAM?

CK_beats

bpsintl
RspamD works with so-called symbols.
When each email arrives or goes out, you can see RspamD’s rating by turning the + in front of the ID into a - (unfolding it).
RspamD can e.g. B. negatively evaluate the origin (IP / country) or a known SPAM address. How difficult you determine with the symbols.

You can search for and adjust the weighting of the individual points using the “Smbols” tab. The more negative the rating, the more likely the email is to be classified as SPAM.
In the “Configuration” tab you can set the value at which an email will be moved to the SPAM folder or alternatively rejected completely (i.e. not delivered outbound).

ETNyx

Hi,

if you want to limit your users per day basis you need to work it out whit your users,… Important about this limit is accounting. Each message is acounted, so if you users are sending mails using multiple to,cc,bcc each of recipient is 1 message. So let’s say your limit is 100/day, your users always send mail to 5 recipient, than what seems to be reasonable limit of 100 mails is just 25.

So at least inform your users about your restriction. If your user base use Outlook and they hit this restriction, they usually does not see this, Outlook does not tell that message can not be sent.

Any way, even if you limit your users reasonable, it’s a good to make your self some kind of analytics/alerting. Unfortunately MC does not provide this capability. But you can forward all of your logs to external system and make some analytics/alerting there. I personally forward all logs to Loki and I got some dashboards in Grafana including alerting.

Also recently there was interesting third-party project tailored for MC (forum, git). Not sure if this project do what you need, but you can try to ask or make PR

bpsintl

Excellent, thanks for the advice, I will look into that.

shlomi

I’m planning to address this specifically in future versions of mailcow-logs-viewer. Since the app already tracks all email traffic, I intend to go beyond simple log viewing. I’ll be adding features to monitor the volume of valid vs. bounced emails per user, which will allow the system to proactively alert administrators about potentially problematic or compromised accounts.

bpsintl

shlomi excellent, I will look into setting this up on our server!

bpsintl

shlomi I’m looking to setup your mailcow-logs-viewer and the instructions mention to access it on localhost. I want to set this up on a sub domain on my mailserver. How do I do that please?

shlomi

bpsintl
You can

open the mailcow-logs-viewer web port in firewall (if you have one) and then point sub.domain.com to the server’s IP address.
then the web ui will be http://sub.domain.com:8080
Or, and this is my recommendation, use a reverse proxy.

bpsintl

shlomi Ahh, so if my mailcow admin UI is accessed via mail.domain.com, following your default instructions I would access the mailcow-logs-viewer on mail.domain.com:8080 ?

shlomi

bpsintl
yes
If your running it on the same server just be careful to run it in a different folder and not change the mailcow docker-compose files.

bpsintl

shlomi yes it’s on the same server. Thanks!

bpsintl

shlomi I’ve got mailcow-logs-viewer running now and I can access it on port 8080. How to I secure it to access it over ssl though? My browser conplains that it’s not secure

esackbauer

bpsintl
Use a reverse proxy or VPN.

bpsintl

esackbauer Thanks, I’ve got it working with a Cloudflare tunnel!