Re: 90_2tld.cf / / 90_3tld.cf

2010-02-02 Thread Yet Another Ninja
On 2/1/2010 10:50 PM, Karsten Bräckelmann wrote: On Mon, 2010-02-01 at 22:33 +0100, Yet Another Ninja wrote: - If someone knows how to put these two rule sets in one file and activate according to SA version, pls let me know... I'm stumped. Preprocessing Options [1] in the SA Conf

Re: warn: reporter: DCC report via dccproc failed

2010-02-02 Thread Matus UHLAR - fantomas
you did a spamassassin -r? On 01.02.10 06:07, Chris wrote: In a way yes, I run a perl script that runs sa-learn and also reports the spam to razor/pyzor/DCC all in one run. On Mon, 2010-02-01 at 17:49 +0100, Matus UHLAR - fantomas wrote: now, how does this differ from running

Avoid ham to be taken for spam

2010-02-02 Thread Kārlis Repsons
Hi, in fact, all spam filters are normally designed with an intent to get rid of spam, not ham, but anyway, I'm confused with my possible chances to miss some mails for no really valid reason. I've seen that long list in [1], but that doesn't say much of what should be avoided. For example, I

RE: 90_2tld.cf / / 90_3tld.cf

2010-02-02 Thread Randal, Phil
There's an extraneous linebreak or two in there: # SA 3.3.0 if (version = 3.003000) Cheers, Phil -- Phil Randal | Networks Engineer NHS Herefordshire Herefordshire Council | Deputy Chief Executive's Office | I.C.T. Services Division Thorn Office Centre, Rotherwas, Hereford, HR2 6JT Tel:

Re: Avoid ham to be taken for spam

2010-02-02 Thread RW
On Tue, 2 Feb 2010 11:47:00 + Kārlis Repsons karlis.reps...@gmail.com wrote: Hi, in fact, all spam filters are normally designed with an intent to get rid of spam, not ham, but anyway, I'm confused with my possible chances to miss some mails for no really valid reason. I've seen that

Re: 90_2tld.cf / / 90_3tld.cf

2010-02-02 Thread Yet Another Ninja
On 2/2/2010 1:03 PM, Randal, Phil wrote: There's an extraneous linebreak or two in there: # SA 3.3.0 if (version = 3.003000) SA 3.3.0 was missing a comment... fixed thx

SA 3.3.0 + PhishTag

2010-02-02 Thread Hans-Werner Friedemann
What I have to do, when the following Message appears in my spamd.log? info: rules: meta test HARD_URL has dependency 'HTTPS_IP_MISMATCH' with a zero score. It appears when I´ve installed the PhishTag.pm and PhishTag.cf. I´ve searched for a resolution in the 50_score.cf but I could´nt find

SA Blacklist for Display Names?

2010-02-02 Thread Daniel R.
Hi All, we get a lot of Spam with some bad Words in the Display name of the sender. With the blacklist_from command it is possible to filter by email-address, but what is the right notation for filtering the display name of the sender? can you please helb me? Thanks a lot, bye Daniel -- View

Re: SA Blacklist for Display Names?

2010-02-02 Thread Martin Gregorie
On Tue, 2010-02-02 at 05:13 -0800, Daniel R. wrote: Hi All, we get a lot of Spam with some bad Words in the Display name of the sender. With the blacklist_from command it is possible to filter by email-address, but what is the right notation for filtering the display name of the sender? can

Re: How should this tricky spam be filtered?

2010-02-02 Thread RW
On Mon, 01 Feb 2010 12:09:24 -0500 Adam Katz antis...@khopis.com wrote: Martin Gregorie wrote: There was a recent suggestion that 'personal name' text from the From: header should be included in the text examined by 'body' rules, which already includes the Subject: text. This sounds like

Re: Avoid ham to be taken for spam

2010-02-02 Thread Matus UHLAR - fantomas
On 02.02.10 11:47, Kārlis Repsons wrote: in fact, all spam filters are normally designed with an intent to get rid of spam, not ham, but anyway, I'm confused with my possible chances to miss some mails for no really valid reason. _any_ spam filter can have false positives. If there was spam

Re: Avoid ham to be taken for spam

2010-02-02 Thread Kārlis Repsons
On Tuesday 02 February 2010 15:08:01 Matus UHLAR - fantomas wrote: On 02.02.10 11:47, Kārlis Repsons wrote: in fact, all spam filters are normally designed with an intent to get rid of spam, not ham, but anyway, I'm confused with my possible chances to miss some mails for no really valid

Re: Avoid ham to be taken for spam

2010-02-02 Thread Mike Cardwell
On 02/02/2010 15:21, Kārlis Repsons wrote: By the way, I feel interested in scores. For example, I've set up an automatic sorting, which divides spam into three categories: gray, certain, heavy. I was looking at that STATISTICS.txt and my first impression about boundaries was: {4, 6.6, 8}, 4

Re: permission denied error keeps coming back

2010-02-02 Thread Bowie Bailey
tonjg wrote: ever since I did a bayes learn on 200 spams and 200 hams a couple of days ago I've had the following error appearing in my mail log: 'mimedefang-multiplexor[13951]: Slave 0 stderr: bayes: locker: safe_lock: cannot create tmp lockfile

Re: permission denied error keeps coming back

2010-02-02 Thread tonjg
Bowie Bailey wrote: ...Check the permissions on the /var/lib/spamassassin/bayes directory and contents. Make sure the mimedefang user can read and write to the directory as well as all of the files. ok thanks for your response bowie. I looked at the var/lib/spamassassin/bayes directory in

Sought rules not doing so good

2010-02-02 Thread Bowie Bailey
Since the sought rules have been updating for a while now, I took a look at my stats to see how they were doing. They used to be one of my most useful rules, but recently, they don't seem to be doing so good. Here are the stats for the last month: TOP SPAM RULES FIRED

Re: Sought rules not doing so good

2010-02-02 Thread Adam Katz
Bowie Bailey wrote: Since the sought rules have been updating for a while now, I took a look at my stats to see how they were doing. They used to be one of my most useful rules, but recently, they don't seem to be doing so good. Here are the stats for the last month: That looks like the

Re: Avoid ham to be taken for spam

2010-02-02 Thread Marc Perkel
Kārlis Repsons wrote: Hi, in fact, all spam filters are normally designed with an intent to get rid of spam, not ham, but anyway, I'm confused with my possible chances to miss some mails for no really valid reason. I've seen that long list in [1], but that doesn't say much of what should be

Re: _TOKENSUMMARY_ not working in 3.3.0?

2010-02-02 Thread Mark Martinec
Chris, Thanks Mark, yes that did fix the problem though only after I changed the order in which my add_header all statements were placed in my local.cf. For instance, with 3.2.5 I had: add_header all Status _YESNO_, score=_SCORE_ required=_REQD_ tests=_TESTSSCORES_ _TESTS_

Re: Avoid ham to be taken for spam

2010-02-02 Thread Marc Perkel
If you are worried about losing good email add this rule to your ruleset: header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal', '127.0.0.1') describe RCVD_IN_HOSTKARMA_W Sender listed in HOSTKARMA-WHITE tflags RCVD_IN_HOSTKARMA_W net nice score RCVD_IN_HOSTKARMA_W -5 This is

Re: Sought rules not doing so good

2010-02-02 Thread Bowie Bailey
Adam Katz wrote: Bowie Bailey wrote: Since the sought rules have been updating for a while now, I took a look at my stats to see how they were doing. They used to be one of my most useful rules, but recently, they don't seem to be doing so good. Here are the stats for the last month:

Re: Sought rules not doing so good

2010-02-02 Thread Warren Togami
On 02/02/2010 12:07 PM, Adam Katz wrote: That is quite different from our masscheck stats. Today's results at http://ruleqa.spamassassin.org/20100201/%2FJM_SOUGHT look like this: SPAM% HAM% S/ORANK SCORE NAME 9.8564 0.0042 1.0000.940.01 T_JM_SOUGHT_3

Re: Avoid ham to be taken for spam

2010-02-02 Thread Mark Martinec
On Tuesday 02 February 2010 18:53:35 Marc Perkel wrote: If you are worried about losing good email add this rule to your ruleset: header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal', '127.0.0.1') describe RCVD_IN_HOSTKARMA_W Sender listed in HOSTKARMA-WHITE tflags

Re: Avoid ham to be taken for spam

2010-02-02 Thread Marc Perkel
Mark Martinec wrote: On Tuesday 02 February 2010 18:53:35 Marc Perkel wrote: If you are worried about losing good email add this rule to your ruleset: header RCVD_IN_HOSTKARMA_W eval:check_rbl_sub('HOSTKARMA-lastexternal', '127.0.0.1') describe RCVD_IN_HOSTKARMA_W Sender listed in

Rules for not passing SPF

2010-02-02 Thread Darxus
Ideally everyone would pass these. meta SPF_HELO_NOT_PASS !SPF_HELO_PASS meta SPF_NOT_PASS !SPF_PASS These will catch everything that does not have a valid SPF record, including those for domains that have no SPF record. I tested only the most recent 1,000 emails from my inbox,

Re: Rules for not passing SPF

2010-02-02 Thread Marc Perkel
dar...@chaosreigns.com wrote: Ideally everyone would pass these. meta SPF_HELO_NOT_PASS !SPF_HELO_PASS meta SPF_NOT_PASS !SPF_PASS These will catch everything that does not have a valid SPF record, including those for domains that have no SPF record. I tested only the most

Re: Rules for not passing SPF

2010-02-02 Thread Ned Slider
dar...@chaosreigns.com wrote: Ideally everyone would pass these. and ideally we'd live in a world with no spam. meta SPF_HELO_NOT_PASS !SPF_HELO_PASS meta SPF_NOT_PASS !SPF_PASS These will catch everything that does not have a valid SPF record, including those for domains

Re: Rules for not passing SPF

2010-02-02 Thread Darxus
On 02/02, Marc Perkel wrote: Why would you want to catch domains without SPF as SPF has no relationship to detecting spam? SPF is entirely about spam. http://www.openspf.org/Introduction If everyone uses SPF, all we need to block all spam is these rules (SPF_NOT_PASS alone should do it),

Re: Rules for not passing SPF

2010-02-02 Thread Daniel McDonald
On 2/2/10 5:38 PM, dar...@chaosreigns.com dar...@chaosreigns.com wrote: On 02/02, Marc Perkel wrote: Why would you want to catch domains without SPF as SPF has no relationship to detecting spam? SPF is entirely about spam. Sorry, but SPF is entirely about ham. We use SPF with vendors

Re: Rules for not passing SPF

2010-02-02 Thread Ned Slider
dar...@chaosreigns.com wrote: On 02/02, Marc Perkel wrote: Why would you want to catch domains without SPF as SPF has no relationship to detecting spam? SPF is entirely about spam. http://www.openspf.org/Introduction If everyone uses SPF, all we need to block all spam is these rules

Re: Rules for not passing SPF

2010-02-02 Thread Jeff Mincy
From: dar...@chaosreigns.com Date: Tue, 2 Feb 2010 18:38:20 -0500 On 02/02, Marc Perkel wrote: Why would you want to catch domains without SPF as SPF has no relationship to detecting spam? SPF is entirely about spam. Actually, SPF is about forgery and forgery is part

Re: Rules for not passing SPF

2010-02-02 Thread Marc Perkel
dar...@chaosreigns.com wrote: On 02/02, Marc Perkel wrote: Why would you want to catch domains without SPF as SPF has no relationship to detecting spam? SPF is entirely about spam. http://www.openspf.org/Introduction I'm looking at the page and did a search and the word spam is

Re: _TOKENSUMMARY_ not working in 3.3.0?

2010-02-02 Thread Chris
On Tue, 2010-02-02 at 18:52 +0100, Mark Martinec wrote: Chris, Thanks Mark, yes that did fix the problem though only after I changed the order in which my add_header all statements were placed in my local.cf. For instance, with 3.2.5 I had: add_header all Status _YESNO_,

Re: 90_2tld.cf / / 90_3tld.cf

2010-02-02 Thread Daryl C. W. O'Shea
On 01/02/2010 6:51 PM, Adam Katz wrote: Karsten Bräckelmann wrote: The DNS entries for this channel lack version noting as well: People shouldn't be just adding channels at whim. They should read the documentation. If they try to use a channel that's not going to work sa-update won't install