Re: yahoo rcvd bug?

2014-10-22 Thread Quinn Comendant
So apparently on my system—qmail as per qmailtoaster.com—it is by design not to include the rDNS hostname in the Received: … header. See my discussion on the QMT list: http://www.mail-archive.com/qmailtoaster-list@qmailtoaster.com/msg38313.html. So that degrades SA performance huh? At least

Re: General rules for training bayes

2014-10-22 Thread Axb
On 10/22/2014 03:29 AM, Alex Regan wrote: I have the database in a replicated mysql database for now. I'd like to go to redis, but it's not quite ready for distributed configurations, correct? What do you mean by distributed configurations? - many clients querying a central Redis DB? - real

Hacked sites: dropbox V.2

2014-10-22 Thread Axb
uriAXB_URI_MLW_DROPBOX/\/dropbox\/doc\.php$/ score AXB_URI_MLW_DROPBOX25.0 this rule will probably loose it's teeth pretty fast enjoy

Re: tag DKIMDOMAIN is still blocking action 0

2014-10-22 Thread Mark Martinec
Chris, Ran some spam and ham through 'spamassassin -D -t' today mainly looking to see if there were any mention of dns issues as I had reported earlier. At the end of the run I see this whether it's ham or spam: Oct 21 19:30:09.086 [31076] dbg: check: tagrun - tag DKIMDOMAIN is still

Re: General rules for training bayes

2014-10-22 Thread Matus UHLAR - fantomas
On 21.10.14 21:29, Alex Regan wrote: I'm having some trouble with my bayes database, and thought it would be a good time to just rebuild it. I'm wondering if anyone has any good suggestions for the type of mail that should be used for training. be careful about forwarded mail, if possible.

Re: General rules for training bayes

2014-10-22 Thread Benny Pedersen
On October 22, 2014 1:08:45 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: be careful about forwarded mail, if possible. if you get many spam from your old account, it may start to classify ALL mail forwarded through that This only correct if internal networks and or trusted networks is

Re: General rules for training bayes

2014-10-22 Thread Reindl Harald
Am 22.10.2014 um 13:15 schrieb Benny Pedersen: On October 22, 2014 1:08:45 PM Matus UHLAR - fantomas: be careful about forwarded mail, if possible. if you get many spam from your old account, it may start to classify ALL mail forwarded through that This only correct if internal networks and

Re: General rules for training bayes

2014-10-22 Thread Matus UHLAR - fantomas
be careful about forwarded mail, if possible. if you get many spam from your old account, it may start to classify ALL mail forwarded through that On 22.10.14 13:15, Benny Pedersen wrote: This only correct if internal networks and or trusted networks is not configured correct oh, does BAYES

Re: General rules for training bayes

2014-10-22 Thread RW
On Wed, 22 Oct 2014 13:30:44 +0200 Matus UHLAR - fantomas wrote: be careful about forwarded mail, if possible. if you get many spam from your old account, it may start to classify ALL mail forwarded through that On 22.10.14 13:15, Benny Pedersen wrote: This only correct if internal

Re: General rules for training bayes

2014-10-22 Thread Benny Pedersen
On October 22, 2014 1:30:44 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: oh, does BAYES take care about these? we are still talking about manually feeding BAYES, aren't we? Sorry, yes bayes can be ignore all headers if one dont like it to track origin senders or ips

Re: General rules for training bayes

2014-10-22 Thread Reindl Harald
Am 22.10.2014 um 14:30 schrieb Benny Pedersen: On October 22, 2014 1:30:44 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: oh, does BAYES take care about these? we are still talking about manually feeding BAYES, aren't we? Sorry, yes bayes can be ignore all headers if one dont like it to

Re: General rules for training bayes

2014-10-22 Thread Matus UHLAR - fantomas
On October 22, 2014 1:30:44 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: oh, does BAYES take care about these? we are still talking about manually feeding BAYES, aren't we? Am 22.10.2014 um 14:30 schrieb Benny Pedersen: Sorry, yes bayes can be ignore all headers if one dont like it to

Re: General rules for training bayes

2014-10-22 Thread Benny Pedersen
On October 22, 2014 3:05:56 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: On October 22, 2014 1:30:44 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: oh, does BAYES take care about these? we are still talking about manually feeding BAYES, aren't we? Am 22.10.2014 um 14:30 schrieb

Re: General rules for training bayes

2014-10-22 Thread RW
On Wed, 22 Oct 2014 14:44:24 +0200 Reindl Harald wrote: Am 22.10.2014 um 14:30 schrieb Benny Pedersen: On October 22, 2014 1:30:44 PM Matus UHLAR - fantomas uh...@fantomas.sk wrote: oh, does BAYES take care about these? we are still talking about manually feeding BAYES, aren't we?

Re: Hacked sites: dropbox V.2

2014-10-22 Thread Reindl Harald
Am 22.10.2014 um 11:47 schrieb Axb: uriAXB_URI_MLW_DROPBOX/\/dropbox\/doc\.php$/ score AXB_URI_MLW_DROPBOX25.0 this rule will probably loose it's teeth pretty fast thanks, the same applies to googlebox uri RH_URI_MLW_GOOGLEBOX1 /\/googlebox\/document\.php$/ score

Re: tag DKIMDOMAIN is still blocking action 0

2014-10-22 Thread Chris
On Wed, 2014-10-22 at 12:25 +0200, Mark Martinec wrote: Chris, Ran some spam and ham through 'spamassassin -D -t' today mainly looking to see if there were any mention of dns issues as I had reported earlier. At the end of the run I see this whether it's ham or spam: Oct 21

SOUGHT 2.0 ?

2014-10-22 Thread Axb
As most have probably noticed, the SOUGHT rules are not being publish/ updated anymore. (you can shutdown your updates) The reasons for this are beyond this msg. An option was to run such a project under the Apache umbrella but it makes it a VERY complicated process. Thanks to Justin Mason

Re: tag DKIMDOMAIN is still blocking action 0

2014-10-22 Thread Chris
On Wed, 2014-10-22 at 12:25 +0200, Mark Martinec wrote: Chris, Ran some spam and ham through 'spamassassin -D -t' today mainly looking to see if there were any mention of dns issues as I had reported earlier. At the end of the run I see this whether it's ham or spam: Oct 21

Re: tag DKIMDOMAIN is still blocking action 0

2014-10-22 Thread Mark Martinec
Chris, Mark, now I'm confused. As you can see the 'action 0 .' takes place before the DKIM lookup Oct 22 09:16:14.220 [8459] dbg: check: tagrun - action 0 blocking on tags DKIMDOMAIN Yes, that's normal. It happens immediately after basic information has been extracted from a mail header

Re: General rules for training bayes

2014-10-22 Thread Alex Regan
Hi, I'm having some trouble with my bayes database, and thought it would be a good time to just rebuild it. I'm wondering if anyone has any good suggestions for the type of mail that should be used for training. be careful about forwarded mail, if possible. if you get many spam from your old

Re: .link TLD spammer haven?

2014-10-22 Thread Jesse Stroik
I noticed URLs from the TLD .link aren't properly classified on my mail server. I wrote a simple URI rule to recognize that TLD which never matched. I wrote a similar body rule, which did properly match. Interestingly, I do see DNS queries going out for the URLs in question. This is sa

Re: .link TLD spammer haven?

2014-10-22 Thread Ken Bass
On 10/22/2014 2:40 PM, Jesse Stroik wrote: I noticed URLs from the TLD .link aren't properly classified on my mail server. I wrote a simple URI rule to recognize that TLD which never matched. I wrote a similar body rule, which did properly match. Interestingly, I do see DNS queries going out

Re: .link TLD spammer haven?

2014-10-22 Thread Joolee
You can try replacing your RegistrarBoundaries.pm file with the one from trunk. It should be kept up-to-date with the latest TLD craze. As far as I know, it hasn't been tested with 3.2.2 but should work nonetheless.

Re: .link TLD spammer haven?

2014-10-22 Thread Martin Gregorie
On Wed, 2014-10-22 at 13:40 -0500, Jesse Stroik wrote: I noticed URLs from the TLD .link aren't properly classified on my mail server. I wrote a simple URI rule to recognize that TLD which never matched. I wrote a similar body rule, which did properly match. Interestingly, I do see DNS

spamc causing Duplicate emails

2014-10-22 Thread LuKreme
I am seeing duplicate emails when saved off into my Maildirs. My normal mail application ignores these duplicates, but iOS 8 does not, so I need to figure out what's going on. 1412808979.M904650P22299.mail.covisp.net,S=65189,W=66526:2,S

Re: spamc causing Duplicate emails

2014-10-22 Thread John Hardin
On Wed, 22 Oct 2014, LuKreme wrote: I am seeing duplicate emails when saved off into my Maildirs. My normal mail application ignores these duplicates, but iOS 8 does not, so I need to figure out what's going on. 1412808979.M904650P22299.mail.covisp.net,S=65189,W=66526:2,S

Re: spamc causing Duplicate emails

2014-10-22 Thread LuKreme
On 22 Oct 2014, at 19:38 , John Hardin jhar...@impsec.org wrote: On Wed, 22 Oct 2014, LuKreme wrote: I am seeing duplicate emails when saved off into my Maildirs. My normal mail application ignores these duplicates, but iOS 8 does not, so I need to figure out what's going on.

Re: spamc causing Duplicate emails

2014-10-22 Thread John Hardin
On Wed, 22 Oct 2014, LuKreme wrote: Thanks, the questions help me focus on what is really happening. Happy to help. -- John Hardin KA7OHZhttp://www.impsec.org/~jhardin/ jhar...@impsec.orgFALaholic #11174 pgpk -a jhar...@impsec.org key: 0xB8732E79 -- 2D8C 34F4

Re: spamc causing Duplicate emails

2014-10-22 Thread LuKreme
On 22 Oct 2014, at 20:39 , John Hardin jhar...@impsec.org wrote: On Wed, 22 Oct 2014, LuKreme wrote: Thanks, the questions help me focus on what is really happening. Happy to help. Aha. It was procmail. but it was /usr/local/etc/procmailrc :0c /backups/imap.backups if that FAILS, the