Spamdyke: Best open source SPAM protection in Qmail

Spamdyke is a filter for monitoring and intercepting SMTP connections between a remote host and a qmail server. Spam is blocked while the remote server (spammer) is still connected; no additional processing or storage is needed. In a sentence, spamdyke is a drop-in qmail filter for stopping spam at connection-time.

“drop-in” means it can be installed without patching or recompiling qmail, without installing or updating libraries, without drastically reconfiguring anything and without having to become a qmail expert.

“connection-time” means spamdyke evaluates and rejects spam while the remote server is still delivering it. Other filters and anti-spam solutions focus on classifying spam after qmail has accepted it. The spam still has to go somewhere. Even if it’s filed in a folder, it still occupies disk space, consumes server resources and must be deleted by someone. When spamdyke rejects the incoming spam completely, no one has to deal with it. It’s never on the server at all.

Spamdyke: Anti-Spam Filters

Spamdyke boasts a large number of filters for blocking mail from remote servers. Every filter is individually configurable.

spamdyke’s reverse DNS filters can:

Require reverse DNS names.
Require reverse DNS names to resolve with IP addresses.
Require reverse DNS names to be real, not dynamically assigned.
Require the sender’s domain name to have a valid mail exchanger (MX).

spamdyke’s blacklist and whitelist filters can:

Search local IP and reverse DNS blacklist/whitelist files.
Search DNS realtime blacklists/whitelists (DNS RBLs).
Search DNS righthand-side blacklists/whitelists (DNS RHSBLs).
Search sender and recipient blacklist/whitelist files.

spamdyke’s graylist filters can:

Graylist specific recipient domains (activated per domain).
Graylist connections from specific IP addresses or reverse DNS domains.
Enforce minimum and maximum ages for graylist entries.
Skip graylisting for specific domains, IP addresses or reverse DNS domains.

How spamdyke works: When a message is not blocked

Spamdyke works by acting as a middleman between qmail and the network (in Unix terms, it’s a pipe). When no spamdyke filters are triggered and a message is delivered normally, spamdyke silently passes data in both directions. As the SMTP conversation takes place, spamdyke collects a few pieces of data (e.g. the sender and recipient addresses) so they can be logged.

Spamdyke does modify the incoming message in one way. The SMTP protocol requires the remote sender to end every line with a two character terminator — a carriage return and a line feed. Unlike most other mail servers, qmail chooses to strictly enforce this requirement. If a remote sender uses only a line feed to end a line (a typical and easy mistake to make), qmail will reject the message:  451 Error Code.

Because qmail’s strict enforcement of the protocol tends to cause more problems than it solves, spamdyke silently helps mail clients avoid this error by inserting a carriage return before any bare line feed characters it sees. This doesn’t affect the messages; it only allows poorly-written mail clients to send email.

How spamdyke works: When a message is blocked

spamdyke’s filters are described in detail below. When one of them is triggered, spamdyke moves in to block the incoming message.

First, it considers the enabled filters and waits until there is no way the client can avoid a rejection. For example, if authentication could take place but has not done so, spamdyke will wait to see if the remote sender authenticates. Authenticated or whitelisted connections are never filtered.

Next, once spamdyke is certain the message should be filtered, it cuts the connection between the remote sender and qmail. In the background, spamdyke closes the connection to qmail, so qmail will exit normally, believing the remote sender disconnected.

Spamdyke continues sending responses to the remote server, just as qmail would have. Once the remote sender has identified the sender and recipient, spamdyke sends an error code and refuses to accept the message. The remote server disconnects, never knowing that spamdyke hijacked the conversation. spamdyke, meanwhile, uses the sender and recipient information it gathered to construct its log messages.

System Requirements (As our implementation):

CentOS 5.2 (32 bit), Redhat Enterprise Linux 4 and 5 (32 bit), Plesk () Qmail.
It can support other Linux/Unix like Operating System with Qmail as Mail Server.

For installation and configuration you can visit spamdyke website or send us a mail to support (at) diadem (dot) co (dot) in.

Reference: http://www.spamdyke.org