Results 1 to 9 of 9
  1. #1
    Join Date
    Mar 2012
    Posts
    34

    Outgoing Spam Protection

    Hello WHT!

    We have recently been looking into using some sort of filter (onsite server) or something similar to filter out users sending spam like mail due to accounts being compromised for reasons such as running outdated Joomla/Wordpress installs. Essentially what we are looking for is a solution that doesn't require a whole lot of maintenance on our end and for mail to be filtered by software located on one of our servers.

    I came across MailChannels which didn't have a whole lot of reviews and has been operating since 2011.

    I was looking trialing the service when I noticed that their website uses Wordpress, for a company which specializes in mail security and the likes it doesn't really matter, however I then noticed the following

    1. The wp-admin folder hasn't been renamed to a different folder.

    2. Your wp-admin folder is accessible by everyone around the world - http://mailchannels.com/wp-admin

    3. I can almost say for certain seeing as though the above 2 are true that they are most likely using the username "admin" as the username for your Worpdress install.

    From a security perspective I cannot see how a company who offers security solutions to combat outgoing spam would allow the above? How can you expect your clients to trust the service you provide when your website has been developed to be all "marketing" friendly, however the most important aspects such as "security" have been left out? it doesn't give a consumer any confidence in the product at all and ill comfortably say that there would be no way I would put any of my hard earned money into a solution like that.

    The next product is SpamExperts in which I have seen some great reviews on, primarily I wanted to start a discussion to find out what other providers were doing to combat outgoing spam related issue, we are finding that some of our servers are being blacklisted and that we have to monitor our outgoing mail servers a lot more then what we use to which is taking up too much of our time which should be spent on other aspects such as developing the business.

  2. #2
    Join Date
    May 2010
    Location
    Houston
    Posts
    57
    I have experience with MailChannels from around 5 months ago. Overall a good experience, and I would recommend them to someone looking for a relay.

    I was tasked with securing the email systems of a web host, which included a fleet of Windows and cPanel/Linux servers. In the beginning, there were a few issues with non-public RBL's. ie: Clients corporate email systems used an internal RBL, which had their ranges blacklisted. I believe we only had around 50 customers experiencing this, out of a customer base of 10k.

    Aside from that, we had successfully moved 300+ hosts to the MailChannel relays. Exim will need to be tweaked somewhat in order to setup the relay to communicate correctly. hMail setup is 100% easy, and we were able to use vbs scripts to 'mass' push it.

    Once everything was moved over 100%, the numbers came out to around 45% outbound mailicious / spam traffic being caught. With our server sending 5 million plus emails per week, this cut a tremendous amount of spam outbound.

    One caveat we found when dealing with the initial 'learning' of our email traffic, is that we had to start heavily filtering inbound emails for spam. This was due, in our case at least, to a large number of users forwarding 100% of their domain/catchall email traffic to their Google / Yahoo email.

    After setting up a cluster of failover VPS's running rbldnsd with custom and public feeds, I was able to cut down inbound spam around 60%. This greatly improved MailChannels ability to filter the outbound emails.

    All in all, it was a positive experience and I would recommend them. I hope this helps!

  3. #3
    Join Date
    Oct 2004
    Location
    Kerala, India
    Posts
    4,750
    There are a few things that you can do to reduce or prevent spams to a great extend.

    *Extended DNSBL check
    *Outgoing non-smtp spamassassin check
    *Extended spamassassin rules
    *Extended HELO check
    *Limiting max email recipeints in single mails to prevent bulk emailing through mails.
    *Logging mail scripts in apache error logs, so that we can track spamming

    Implementing an upload scan(Both FTP and apache) will prevent malicious scripts from getting uploaded to the server and it can also help in reducing abuse.

    Overall, there should be a mechanism to monitor the mail activities in the server. YOu should be alerted when the mail queue size exceeds X and then you can do something before your IP is blacklisted.
    David | www.cliffsupport.com
    Affordable Server Management Solutions sales AT cliffsupport DOT com
    CliffWebManager | Access WHM from iPhone and Android

  4. #4
    Join Date
    Jan 2003
    Posts
    957
    Quote Originally Posted by david510 View Post

    You should be alerted when the mail queue size exceeds X and then you can do something before your IP is blacklisted.
    Does Cpanel have such an option to alert the admin?

  5. #5
    Join Date
    Oct 2004
    Location
    Kerala, India
    Posts
    4,750
    Quote Originally Posted by tandem View Post
    Does Cpanel have such an option to alert the admin?
    Nope. You will have to add a script to do it automatically.
    David | www.cliffsupport.com
    Affordable Server Management Solutions sales AT cliffsupport DOT com
    CliffWebManager | Access WHM from iPhone and Android

  6. #6
    We are testing SpamExperts at the moment, and have been fairly happy. Setup was a little rough. But it seems to be working good. We're using both inbound and outbound.

    I am looking into an opensource appliance though. I've forgotten the name, starts with a D I think. I was thinking about building it, and letting all my servers go through it for inbound and outbound.

    SpamTitan looked kind of cool, but the licensing doesn't fit for hosting providers. It's per email box, rather than per domain. Since most of us offer unlimited email boxes, that's a cost that could easily run rampant.

  7. #7
    Join Date
    Nov 2009
    Location
    /etc/my.cnf
    Posts
    10,040
    Quote Originally Posted by UH-Bobby View Post
    I am looking into an opensource appliance though. I've forgotten the name, starts with a D I think. I was thinking about building it, and letting all my servers go through it for inbound and outbound.
    Was it DSPAM...?

    If it was maybe this could help: http://applications.cpanel.net/tag/dspam/

  8. #8
    Quote Originally Posted by cd/home View Post
    Was it DSPAM...?
    Ah yes :-). Thanks

    Yeah, DSPAM is it. I haven't looked into it much more, but it sounded good. I read a thread that a host is successfully using it for both inbound and outbound I think.
    Bobby - PreciselyManaged.com - Precision Hosting Solutions
    █ Enterprise Shared, Reseller, VPS, Hybrid, and Dedicated Hosting
    █ SpamExperts | CloudLinux | cPanel | Bacula + R1soft | and more!
    █ Full proactively managed, and we specialize in hosting small web hosts

  9. #9
    Join Date
    Aug 2009
    Location
    Vancouver, Canada
    Posts
    17

    Web site security

    From a security perspective I cannot see how a company who offers security solutions to combat outgoing spam would allow the above? How can you expect your clients to trust the service you provide when your website has been developed to be all "marketing" friendly, however the most important aspects such as "security" have been left out? it doesn't give a consumer any confidence in the product at all and ill comfortably say that there would be no way I would put any of my hard earned money into a solution like that.
    I'm Ken Simpson, the founder and CEO of MailChannels, and I'd like to address your concerns about our approach to web site security and security in general. First, thank you for your post. I always appreciate constructive criticism and your suggestions for making some changes to our WordPress configuration are most welcome.

    We recently re-did our web site, and are hosting it on wp-engine.com, which is a WordPress hosting platform. We chose wp-engine.com to host our site for a variety of reasons, but mostly because of their approach to security. We also migrated our domain to Cloudflare, which adds an extra layer of DNS and HTTP-proxy based security. Cloudflare protected Spamhaus from the largest DDoS in history, and their platform provides a range of other malware and attack prevention measures that we're now benefiting from.

    Here are some of the things wp-engine.com does to ensure the best possible security of WordPress installations (full list is here):

    • They are pen-tested and audited by two different reputable firms: Sucuri and SecTheory
    • Their servers are hosted in a SAS70 environment
    • Installations are hosted in chroot jails
    • Wordpress is automatically updated 24x7 when new issues are discovered


    At MailChannels, we take security very seriously, and it's really part of our DNA. Here are some facts about MailChannels security that you might not know by looking at our web site:

    • Our founding investors include two of the co-founders of CanSecWest (you know, the Pwn2Own people), and we have sponsored the conference since 2005
    • Past technical advisors include Dan Kaminsky and John Graham-Cumming (Cloudflare)
    • We are members of the Messaging Malware Mobile Anti-Abuse Working Group (M3AAWG) and contribute actively to the organization's work
    • The physical location of our office is a secret (spammers don't like us, and they are nasty people)
    • Our web site is hosted in a completely different place than our source code and our services
    • We provide various data feeds to Spamhaus that help them to more quickly identify and categorize spam bots


    With regard to any comparison of our software and services to other solution providers, I only point out that our software is providing outbound spam protection to three of the top five web hosting providers in North America.

Similar Threads

  1. My outgoing mails going to spam
    By jvnadr in forum VPS Hosting
    Replies: 16
    Last Post: 11-29-2012, 07:06 AM
  2. understanding Spam outgoing
    By jolo2 in forum Hosting Security and Technology
    Replies: 3
    Last Post: 04-04-2007, 07:37 AM
  3. outgoing spam protection questions
    By koppan in forum Hosting Security and Technology
    Replies: 5
    Last Post: 02-04-2007, 11:18 AM
  4. Stopping 'outgoing' spam
    By hbhb in forum Hosting Security and Technology
    Replies: 6
    Last Post: 01-02-2007, 09:01 AM
  5. SMTP outgoing IP and spam
    By note560book in forum Dedicated Server
    Replies: 3
    Last Post: 07-10-2005, 09:55 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •