Re: Spam with AWL and Bayes00

2009-03-16 Thread Chris Barnes
Karsten Bräckelmann wrote: On Tue, 2009-03-10 at 10:05 -0500, Chris Barnes wrote: Karsten Bräckelmann wrote: The AWL score for this message is minimal (one can tell by calculating the stock rules' scores without it). Your problem here is BAYES_00 and RCVD_IN_DNSWL_MED. BAYES_00

does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread McDonald, Dan
I've got a false-positive against TVD_PH_REC. The text in part says: THIS REPORT MAY NOT REFLECT THE INFORMATION REGARDING YOUR ACCOUNT FOUND ON THE OFFICIAL RECORDS OF Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender using SPF. However, it appears that the envelope from

Re: SPF_NEUTRAL scoring?

2009-03-16 Thread Kelson
LuKreme wrote: I don't remember what ?all means though, or how it differs from -all or ~all. ? means the record makes no claims about that source. ?all basically says, Mail might come from other places, or it might not, we aren't sure. (In RFC terms, mail from us MAY be sent from other

spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Dennis German
Is there a document regarding the interpretation of sa-learn --dump magic config: could not find site rules directory 0.000 03 0 non-token data: bayes db version 0.000 0 261451 0 non-token data: nspam 0.000 018530

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread RW
On Mon, 16 Mar 2009 11:54:26 -0500 McDonald, Dan dan.mcdon...@austinenergy.com wrote: I've got a false-positive against TVD_PH_REC. The text in part says: THIS REPORT MAY NOT REFLECT THE INFORMATION REGARDING YOUR ACCOUNT FOUND ON THE OFFICIAL RECORDS OF Rather than fiddle with

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Michael Scheidell
Is there a document regarding the interpretation of sa-learn --dump magic config: could not find site rules directory 0.000 03 0 non-token data: bayes db version 0.000 0 261451 0 non-token data: nspam 0.000 0

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread RW
On Mon, 16 Mar 2009 13:23:22 -0400 Dennis German dger...@real-world-systems.com wrote: Is there a document regarding the interpretation of sa-learn --dump magic The are pretty self-explanatory, if you know roughly how Bayes works. The first three are the number of hams and spams

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread McDonald, Dan
On Mon, 2009-03-16 at 17:38 +, RW wrote: On Mon, 16 Mar 2009 11:54:26 -0500 McDonald, Dan dan.mcdon...@austinenergy.com wrote: Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender using SPF. However, it appears that the envelope from address does not have an SPF

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread RW
On Mon, 16 Mar 2009 14:03:47 -0400 Michael Scheidell scheid...@secnap.net wrote: You have 261,451 tokens that appeared in Œspam¹. You have 18,530 tokens that appeard in Œham¹ You have 143,599 tokens (remember, some tokens could appear in both spam and ham) The first two are actually the

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread Matus UHLAR - fantomas
On Mon, 16 Mar 2009 11:54:26 -0500 McDonald, Dan dan.mcdon...@austinenergy.com wrote: Rather than fiddle with TVD_PH_REC, I'd like to whitelist this sender using SPF. However, it appears that the envelope from address does not have an SPF policy; however, the helo record does match:

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Matus UHLAR - fantomas
On 16.03.09 13:23, Dennis German wrote: Is there a document regarding the interpretation of sa-learn --dump magic config: could not find site rules directory 0.000 03 0 non-token data: bayes db version 0.000 0 261451 0 non-token

Re: spamassasin: sa-learn --dump magic intrepretation

2009-03-16 Thread Matt Kettler
Michael Scheidell wrote: Is there a document regarding the interpretation of sa-learn --dump magic config: could not find site rules directory 0.000 03 0 non-token data: bayes db version 0.000 0 261451 0

Preview with guessed encoding

2009-03-16 Thread Andrzej Adam Filip
What is the recommended way to get utf8 content of spam message in cases when: 1) spam message misses charset declaration (common for TW spam) 2) TextCat Plugin detects language *and charset* In case of one specific spam: * TextCat detects zh.big5 * $status-get_content_preview() return

Re: does whitelist_from_spf match SPF_HELO_PASS?

2009-03-16 Thread Daryl C. W. O'Shea
SPF_HELO_PASS is NOT considered by whitelist_from_spf. Daryl

HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
Received a mail in my inbox today that was definitely spam but scored as below. After running it through spamassassin -r and -t and removing the senders address from the autowhitelist I got it to score X-spam-status: No, score=-0.1 required=5.0 tests=ADVANCE_FEE_2=1.234,

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Greg Troxel
The wiki now has an email address to report Habeas-accredited spam: http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI pgp8bfg8GvsBB.pgp Description: PGP signature

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread Chris
On Mon, 2009-03-16 at 19:46 -0400, Greg Troxel wrote: The wiki now has an email address to report Habeas-accredited spam: http://wiki.apache.org/spamassassin/Rules/HABEAS_ACCREDITED_COI Thanks Greg, I've reported it to them -- KeyID 0xE372A7DA98E6705C signature.asc Description: This is

Re: spamassasin: sa-learn --dump magic interpretation good/bad/other?

2009-03-16 Thread Dennis German
0) Michael, thanks 1) what are the various zero columns?? for example in 0.000 0 3 0 non-token data: bayes db version 2) Is this good? not too good? bad? trouble? On Mar 16, 2009, at 14:03, Michael Scheidell wrote: Is there a document regarding the interpretation

JoeJobbed - Vbounce plugin - SPF?.

2009-03-16 Thread Michael Hutchinson
Hello everyone, I'm running Spamassassin 3.1.7, with netqmail 1.05, ClamAv etc.. We've been subject to being joe-jobbed on one of our domains here at work. We were lucky as we were able to switch off delivery to the affected domain and effectively blocked the blowback by refusing E-Mail from all

Re: HABEAS_ACCREDITED_COI

2009-03-16 Thread LuKreme
On 16-Mar-2009, at 16:40, Chris wrote: -8.0 HABEAS_ACCREDITED_COI RBL: Habeas Accredited Confirmed Opt-In or Better [208.82.16.109 listed in I changed my HABEAS scores ages ago: score HABEAS_ACCREDITED_COI -1.0 score