Re: more_spam_from like more_spam_to

2014-09-19 Thread Matus UHLAR - fantomas
On Wed, 17 Sep 2014 13:43:49 +0100, RW rwmailli...@googlemail.com wrote: RW A lot of people don't put mailing lists through Spamassassin, most RW of them have already been spam filtered, and to get the best results RW you have to extend your internal network and maintain it. On 18.09.14 22:09,

Re: Simple question: load balancing spamd

2014-09-19 Thread Jari Fredriksson
18.09.2014, 22:58, Bob Proulx kirjoitti: Jari Fredriksson wrote: haproxy is just a small app capable of working as a proxy for http or plain tcp connections. HA. What are you using for the Bayes database on the distributed compute farm? (Just curious...) Bob MySQL /MariaDB 5.5

Re: more_spam_from like more_spam_to

2014-09-19 Thread Ian Zimmerman
On Fri, 19 Sep 2014 08:37:45 +0200, Matus UHLAR - fantomas uh...@fantomas.sk wrote: RW A lot of people don't put mailing lists through Spamassassin, most RW of them have already been spam filtered, and to get the best results RW you have to extend your internal network and maintain it. Ian Do

Re: more_spam_from like more_spam_to

2014-09-19 Thread RW
On Thu, 18 Sep 2014 22:09:23 -0700 Ian Zimmerman wrote: On Wed, 17 Sep 2014 13:43:49 +0100, RW rwmailli...@googlemail.com wrote: RW A lot of people don't put mailing lists through Spamassassin, most RW of them have already been spam filtered, and to get the best RW results you have to

Re: more_spam_from like more_spam_to

2014-09-19 Thread Reindl Harald
Am 19.09.2014 um 13:44 schrieb RW: On Thu, 18 Sep 2014 22:09:23 -0700 Ian Zimmerman wrote: On Wed, 17 Sep 2014 13:43:49 +0100, RW rwmailli...@googlemail.com wrote: RW A lot of people don't put mailing lists through Spamassassin, most RW of them have already been spam filtered, and to get

Re: more_spam_from like more_spam_to

2014-09-19 Thread Martin Gregorie
On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote: Am 19.09.2014 um 13:44 schrieb RW: On Thu, 18 Sep 2014 22:09:23 -0700 Ian Zimmerman wrote: On Wed, 17 Sep 2014 13:43:49 +0100, RW rwmailli...@googlemail.com wrote: RW A lot of people don't put mailing lists through

Re: more_spam_from like more_spam_to

2014-09-19 Thread Matus UHLAR - fantomas
RW A lot of people don't put mailing lists through Spamassassin, most RW of them have already been spam filtered, and to get the best results RW you have to extend your internal network and maintain it. Matus no... they do not filter mail from mailing lists through SA. it Matus is setting in

Re: more_spam_from like more_spam_to

2014-09-19 Thread Reindl Harald
Am 19.09.2014 um 14:42 schrieb Martin Gregorie: On Fri, 2014-09-19 at 13:47 +0200, Reindl Harald wrote: Most DNSBL tests are done on the last relay into the internal network. I'm not say this should be done, I'm saying that it's one reason why scanning mailing list can be more trouble than

sa-learn strip last Received: header for own MDA

2014-09-19 Thread Marcus Schopen
Hi, still playing with sa-learn. If I feed sa-learn do I have to strip the last Received: header which is the Received header for my own MDA (imap-backend) before piping the message into sa-learn? Return-Path: spam...@whatever.com --- strip this header? -- Received: from

Re: sa-learn strip last Received: header for own MDA

2014-09-19 Thread John Hardin
On Fri, 19 Sep 2014, Marcus Schopen wrote: still playing with sa-learn. If I feed sa-learn do I have to strip the last Received: header which is the Received header for my own MDA (imap-backend) before piping the message into sa-learn? No, that shouldn't matter. The common bits will be

Spamhaus timeouts -- are they being DDoSed again?

2014-09-19 Thread Justin Edmands
I caught wind from a post on ddos-protection.org that Spamhaus is getting DDoS attacked again. We are getting timeouts to spamhaus servers intermittently. One test scan will work properly with no timeouts, the next will say deadline shrunk, then the calling callback/abort on key and spam will flow

Re: spamassassin rule to combat phishing

2014-09-19 Thread francis picabia
On Tue, Sep 16, 2014 at 5:27 PM, John Hardin jhar...@impsec.org wrote: On Tue, 16 Sep 2014, francis picabia wrote: Hello, We just received the most authentic looking phishing I've seen. It was professionally written, included a nice signature in the style used by people at my workplace,

New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread David B Funk
Seeing spam with URLs in new TLDs, (EG blah.link) time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job? -- Dave Funk University of Iowa dbfunk (at)

Re: New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread Kevin A. McGrail
On 9/19/2014 4:23 PM, David B Funk wrote: Seeing spam with URLs in new TLDs, (EG blah.link) time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job? We are working on solutions expected for the

Re: New TLDs, time to update RegistrarBoundaries

2014-09-19 Thread Axb
On 09/19/2014 10:23 PM, David B Funk wrote: Seeing spam with URLs in new TLDs, (EG blah.link) time to update RegistrarBoundaries. If this silly chase continues at this rate, is it worth trying to come up with some other method of doing that job?

Re: sa-learn strip last Received: header for own MDA

2014-09-19 Thread LuKreme
On 19 Sep 2014, at 09:06 , Marcus Schopen li...@localguru.de wrote: still playing with sa-learn. If I feed sa-learn do I have to strip the last Received: header which is the Received header for my own MDA (imap-backend) before piping the message into sa-learn? All you need to do is make sure