Better spam handling in (or before) holding pen

[crowbot]

The volume of spam in the holding pen in WDTK has increased. Come up with some strategies to make this more managable.

[hsenag]

Of 11 spams today so far:

8 were sent "To" the same address, which was a nearly valid old request address - correct hash, but missing the second hyphen.

1 was sent "To" an invalid request address (nearly correct hash) 1 was sent "BCC" a valid request address

1 was sent "BCC" request@whatdotheyknow.com

If a spam was sent "To" an old valid request address then it would be rejected.

It's not entirely safe to just reject mails to old requests with any hash, because sometimes authorities miss out a digit in the request number, though perhaps simply getting a failure bounce would cause them to check.

In any case that wouldn't trivially catch the most frequent case above as it doesn't have an obvious request number.

My initial thought is that if there was an easy way to set an arbitrary "To" address to auto-reject in the same way as for a valid request address, we could cut down the volume quite substantially with minimal effort.

[hsenag]

I've extended this analysis to the last two weeks. Pretty much the same pattern as above, typically with the same addresses, total count over the two weeks is approximately 50.

One new kind I saw (once only) was multiple valid request addresses in the To header.

[crowbot]

Adding a list of "To" addresses to auto-reject seems like it shouldn't be too hard.

• [x] Create spam_address model
• [ ] Add code to RequestMailer.receive to check the list of spam addresses and silently discard an incoming mail if it's addressed to one of them
• [ ] Add page to admin interface for adding/removing spam addresses

[garethrees]

Should we be using greylisting as a more robust/scalable way of filtering obvious spam?

• postgrey for postfix
• exim

We should also be able to configure the MTA to reject from known spammers.

There's also spamassassin, but that's probably a bit more heavyweight.

Other links

• http://www.postfix.org/postscreen.8.html