Spam issues and how to overcome them

[Homer Dokes]

Greetings all,

So after having employed two kolab servers for over a year now, spam is 
still a huge problem.

I have found it very difficult to understand how kolab is employing the 
tools to combat spam through the server and I can find nothing but 
generalities when it comes to configuring for a sound anti-spam 
regiment.  I can find some actual configurations for earlier versions 
than Kolab 3.4 but it is obvious they don't apply to 3.4 due to changes 
in naming conventions, locations, etc. so while giving 'some' idea of 
how to configure it... it's a guessing game on what and how it applies 
to Kolab 3.4.

Allow me to review my experiences thus far and some actual issues and 
results.

I have two servers running Kolab.  One is in a world wide retail 
environment, the other a localized service environment.

Current conditions:

     Debian 7.0 (Wheesy)
     Kolab 3.4 with the latest updates as of 6/11/2016
     Amavis-new
     Spamassissin
     Razor
     Pyzor
     Clamav
     Sieve
     Utilization of Spam block lists

I have employed most of the tactics described in this document 
https://lists.kolab.org/pipermail/users/2015-September/019923.html but 
still have insurmountable amounts of spam making it through the system.  
The two servers have been in place and fully functional for over a 
year.  The spam configurations have been running with the latest 
definitions and settings for over 4 weeks.

I have employed bayes rules, downloaded pre-definitions for them, and 
continue to use sa-learn on a daily basis through 150+ email boxes to 
'learn' what is spam through the users junk boxes but it has made 
absolutely no difference.  The same emails keep coming through and the 
spam scoring is all over the map.  No consistency to it at all.  Here is 
the header of an example of a spam that come through many times a day, 
has 100's of entries in the Junk folders of users, and yet continues to 
enjoy a spam score of 1.342... far below the recommended threshold of 
6.31 which is the initial default of the configuration and certainly 
well below the 3.0 that I set trying to get closer to the scores the 
spam emails are getting.:

Return-Path: 
<2472-838548814-88-recipient=yadayada.com at mail.elementdooraim.com>
Received: from mail.yadayada.com ([unix socket])
     by mail (Cyrus git2.5+0-Debian-2.5~dev2015021301-0~kolab1) with LMTPA;
     Sat, 11 Jun 2016 08:46:54 -0400
X-Sieve: CMU Sieve 2.4
X-Virus-Scanned: Debian amavisd-new at yadayada.com
X-Spam-Flag: NO
X-Spam-Score: 1.342
X-Spam-Level: *
X-Spam-Status: No, score=1.342 tagged_above=-10 required=3
     tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1,
     DKIM_VALID_AU=-0.1, HTML_IMAGE_ONLY_16=1.092, HTML_MESSAGE=0.001,
     HTML_SHORT_LINK_IMG_2=0.001, MPART_ALT_DIFF=0.79,
     RCVD_IN_BRBL_LASTEXT=1.449, SPF_PASS=-0.001, T_REMOTE_IMAGE=0.01]
     autolearn=no
Received: from maria.elementdooraim.com (64-16-218-71.static.sagonet.net
     [64.16.218.71])
     by mail.yadayada.com (Postfix) with ESMTP id 8B8EF53C8
     for <recipient at yadayada.com>; Sat, 11 Jun 2016 08:46:50 -0400 (EDT)
DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; s=k1; 
d=elementdooraim.com;
h=Mime-Version:Content-Type:Date:From:Reply-To:Subject:To:Message-ID;
     i=info at elementdooraim.com; bh=Y/a1tdkArMQ8RCID0h3i1qWZh7k=;
b=QcQOWDYWhfBwK0oWa4dx1Q5kzLf9CATzFNWO4T5rk1cRPWC3UkqZb3eeQKkN+fOx+J7WrG4YrX4d
e0Lb83zfjy9ppabQL9c3Xq1TX7EURamDq2vQDgW1wlBu1XNsh9xMjXj/9MLVZ5lzqrT04i5XiAcM
     aX5d/tFQyXonE9SZPPQ=
DomainKey-Signature: a=rsa-sha1; c=nofws; q=dns; s=k1; d=elementdooraim.com;
b=Tn1vY7j32iXCGJRBVwMVwf3cOhFw8Zi8UsrG/mJ2fEhPVotOCQFSQJVnoxEqG26G6Io9zebXzw1y
sOeFozxSf6+bmvOpMXdyYI4TSNxudp5PnKeLquFIVEh8WfvHvON8b3Hc5ZwW4cgDptLM4z1yv9NV
     n66xK1DMjzeO58bQ00c=;
Mime-Version: 1.0
Content-Type: multipart/alternative;
     boundary="18112c6dd97e31c483b0c78bfc6a8313"
Date: Sat, 11 Jun 2016 05:42:13 -0700
From: "x-700 Pocket Flashlight" <info at elementdooraim.com>
Reply-To: "x700 Pocket Flashlight" <info at elementdooraim.com>
Subject: DEADLY Pocket Flashlight (A Must Have)!
To: <recipient at yadayada.com>
Message-ID: <0.0.838548814.teuwyd31fb3d4ecjsafp461081.0 at elementdooraim.com>
X-Wallace-Footer: YES

One would have thought that the range of the spam scores would start 
from zero and move in a positive direction however I have actually seen 
spam scores with a negative value.  What IS the range of the score?  
What is it's lowest point and what is it's highest point and how does it 
get calculated?

I have also recognized that most of the spam comes through a previous 
FQDN which, while it hasn't been used for years, we still get valid 
email to this address and therefore it has been embedded for every user 
in their email box set up as a secondary domain.  As such I set up sieve 
rules to push all emails going to that address into it's own folder for 
each user, only to realize that it is only moving about 50% of the 
emails addressed to that domain to the folder that was set up.  The 
other 50% still end up in their main inbox.  How is this possible?  The 
sieve rule is based ONLY on the 'To:' address and there is only the 
users address with the old domain in that field.  How does it work 50% 
of the time and 50% not?

I have a tremendous number of pissed users because they spend more time 
sifting then addressing legitimate emails.  I'd be better off defining 
go/no go folders that when an email is placed into the 'no go' as an 
example, it is blacklisted and never allowed to come through again but I 
can find no information with Kolab references on how to accomplish 
this.  Is Kolab capable of setting up for the user a black and white 
list through roundcubemail.  If so can someone point me to a tutorial or 
example of a configuration?

Can an administrator of Kolab look to the individual package's own 
website documentation for configuration or because of the 'fit' into 
Kolab 3.4 are those configurations meaningless?  Example... I understand 
that running spamd is NOT what you want to do in Kolab 3.4 because 
Amavis-new actually contains some of the libraries of Spamassassin and 
makes calls implicitly for Spamassassin features and does not work with 
spamd at all.  That alone seems to throw all the individual package's 
documentation out the window as we are starting from the same base.

I have owned and ran an ISP for 15 years and dissolved it 18 months ago 
and have used a wide variety of email server platforms.  After the ISP, 
I decided to take the plunge into Kolab but having administered it over 
the last year I've really called into question it's viability as a sound 
and easily maintained email platform. Quite the contrary, I have found 
it to demand more of my time than any other platform I have used.  
Should it be this way?  Am I overlooking something?  In the end... it is 
really the lack of consistent and applicable documentation for the Kolab 
environment that has made the experience so exasperating.  I am certain 
that the package over all can be and probably is a sound package, but if 
one can not find the documentation that speaks to the uniqueness that is 
Kolab, how does one come out of it with a positive take?

In the end, what I am looking for is how does kolab 'alter' the methods 
of the anti-spam tools (amavis-new, spamassassin, razor, pyzor, etc), 
from a wrapper and configuration standpoint, from their respective 
'stand alone' configurations.   Is there a kolab version specific 
reference for a functional spam configuration.  I am continually 
surprised at what appears to be a tremendously inadequate repository of 
information for Kolab (specifically 3.4) vs. the number of users the 
platform has out there.  I know I can't be the only one experiencing 
these issues, or, is it that I just haven't found the 'holy grail' 
repository of Kolab 3.4 information.

I would appreciate any assistance I can get here with this.  I am to far 
invested into the Kolab platform at this time to drop it and move to 
something else.

Thank you,

hdokes